Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 16:14
General
- Target Client-built.exe
- Size 3.1MB
- Sample260601-tp5vaabw5p
- SHA256 82b10eea38e03aa8deebcefa2598c4276a28a338b07dfcc98aa9e43b94d71af9
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
r0joxce8ac.localto.net:2601
Mutex
-
217ad2d3-126c-4c5c-a3c1-48df0c40d80b
Attributes
-
encryption_key
5B27051D67AA2CCE9314596003B68709A13FC003
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4296-0-0x0000000000FA0000-0x00000000012C4000-memory.dmp
memory/4296-1-0x0000000003410000-0x0000000003420000-memory.dmp
memory/4296-2-0x000000001D8F0000-0x000000001D940000-memory.dmp
memory/4296-3-0x000000001DA00000-0x000000001DAB2000-memory.dmp
memory/4296-4-0x0000000003410000-0x0000000003420000-memory.dmp