quasar | 43c972c6583a4f18778945dd15d948de7de4c4fe2ce5b5989fc2ec572a7b52da

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/05/2026, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe
Size 153KB
Sample260515-vg83eags4p
SHA256 43c972c6583a4f18778945dd15d948de7de4c4fe2ce5b5989fc2ec572a7b52da
MD5 9f231b51ec30b41502988cc8205c112d
SHA1 2d5d0942d1238115f3982d2789fa340ad4a6c450
SHA512 2ba7a0d189bed5ac675e8aaee45823c98c1efdf7085ead62a33a86b46c4a04201f9825c514c6f08d786b5f4f2b7c66b2919df5d52f9d8c95146e10f0aac300d8
SSDEEP 3072:jGXJ7Zmel5h7udEE0FNhm1PNxG5oY49bYq:jo9mejcdpOA1d9M
TLSH
T106E34A0B73B930F9E1778138C4A15A11F772B8761760ABAF07A046761F236D09D7BBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

052026 execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

212.22.82.148:9044;

Botnet

052026

https://pastebin.com/raw/3Gsg7PXu

Mutex

3f89b6af-8ae1-442c-9e44-1494590f8e25

Attributes

encryption_key
9DBCAEB4792AAD51B5F52A2E22511DC5770D487C
install_name
cache.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
LCache
reconnect_delay
2745
startup_key
Update Checker
subdirectory
DSCache

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243ff-16.dat	family_quasar
behavioral1/memory/1508-26-0x00000000003C0000-0x00000000006E4000-memory.dmp	family_quasar

Custom signature

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243ff-16.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/1508-26-0x00000000003C0000-0x00000000006E4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243ff-16.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral1/memory/1508-26-0x00000000003C0000-0x00000000006E4000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing common artifacts observed in infostealers 2 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000243ff-16.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral1/memory/1508-26-0x00000000003C0000-0x00000000006E4000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1400	powershell.exe
1400	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
1	2748	2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe

Executes dropped EXE 3 IoCs

pid	Process
1508	mtkadk.exe
1528	cache.exe
2216	cache.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
34	pastebin.com
35	pastebin.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4380	schtasks.exe
2496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1400	powershell.exe
1400	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	1508	mtkadk.exe
Token: SeDebugPrivilege	1528	cache.exe
Token: SeDebugPrivilege	2216	cache.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1528	cache.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1400	2748	2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe	84
PID 2748 wrote to memory of 1508	2748	2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe	86
PID 1508 wrote to memory of 2496	1508	mtkadk.exe	88
PID 1508 wrote to memory of 1528	1508	mtkadk.exe	90
PID 1528 wrote to memory of 4380	1528	cache.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-15_9f231b51ec30b41502988cc8205c112d_cobalt-strike_icedid_satacom_stealc_vidar.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Users\Admin\AppData\Local\mtkadk.exe
  "C:\Users\Admin\AppData\Local\mtkadk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Update Checker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\DSCache\cache.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- - C:\Users\Admin\AppData\Roaming\DSCache\cache.exe
    "C:\Users\Admin\AppData\Roaming\DSCache\cache.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Update Checker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\DSCache\cache.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4380

C:\Users\Admin\AppData\Roaming\DSCache\cache.exe
C:\Users\Admin\AppData\Roaming\DSCache\cache.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_da0rpnfg.2ln.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_da0rpnfg.2ln.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mtkadk.exe

Path C:\Users\Admin\AppData\Local\mtkadk.exe
Size 3.1MB
SHA256 c1ace67ccfe033f88b14bed37a74bb166cf7ebcdfeed8e5ce7976b519e095e03
MD5 7cd5c1b258d059e5d6eaca989dc9cd04
SHA1 9ddb97e56ab4f3d45c7ee637486154125db25989
SHA512 574d47dfc62749880c2d835ce824771cc1b44d271dcb0fb38a55e1e436be05607db35901c51b9686579df0b99ac27d2759b7bb63ff5158c02ec3f398fce3d91f
SSDEEP 49152:Hw/Vm5wDoj3w5PvRB1K/tToGdkTHHB72eh2NT:Hwo5wDoj3w5PvRW
TLSH
T11DE56B1477F85E22E17BD6B3D9B1501263F0F82EF363EB0B6141AA7E5C53B5088126A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1400-1-0x0000019DE0940000-0x0000019DE0950000-memory.dmp

Download

memory/1400-0-0x0000019DE0940000-0x0000019DE0950000-memory.dmp

Download

memory/1400-9-0x0000019DF95D0000-0x0000019DF95F2000-memory.dmp

Download

memory/1508-26-0x00000000003C0000-0x00000000006E4000-memory.dmp

Download

memory/1528-34-0x000000001E0A0000-0x000000001E0F0000-memory.dmp

Download

memory/1528-35-0x000000001E1B0000-0x000000001E262000-memory.dmp

Download

memory/1528-36-0x000000001BD50000-0x000000001BD62000-memory.dmp

Download

memory/1528-37-0x000000001E130000-0x000000001E16C000-memory.dmp

Download