Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
13/04/2026, 07:56
General
- Target Client-built.exe
- Size 3.1MB
- Sample260413-js7g6sfs8j
- SHA256 5b0a18e6a2b26cbb732a66f69a554d1794a2fa7aced6457e1f6f53aefaed5ff6
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
www.msn168.com.tw:4782
-
www.msn168.com.tw:443
-
www.msn168.com.tw:6606
-
www.msn168.com.tw:8844
-
www.msn168.com.tw:7707
-
www.msn168.com.tw:53
-
www.msn168.com.tw:22
-
www.msn168.com.tw:8808
-
3ea0b8ef-2f97-4629-ac32-b1ca15cdbfa6
-
encryption_key
4560792E9B8260B69CFAA6F208427A6A2AA4AF22
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Unexpected DNS network traffic destination
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1928-0-0x0000000000410000-0x0000000000734000-memory.dmp
memory/1928-1-0x0000000000F50000-0x0000000000F60000-memory.dmp
memory/1928-2-0x000000001BDC0000-0x000000001BE10000-memory.dmp
memory/1928-3-0x000000001BED0000-0x000000001BF82000-memory.dmp
memory/1928-4-0x0000000000F70000-0x0000000000F7C000-memory.dmp
memory/1928-6-0x0000000000F50000-0x0000000000F60000-memory.dmp
memory/1928-5-0x0000000000FF0000-0x0000000001002000-memory.dmp