Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
19/06/2026, 14:05
General
- Target Client-built.exe
- Size 1.6MB
- Sample260619-reb34shz21
- SHA256 d39d9c575b61378985fd9cd7d94d71824b6922c71a1f8e619a785e29666943a3
Malware Config
Extracted
-
quasar
-
1.6.2
-
Office04
-
193.8.215.36:14447
-
c309e0cd-1863-44ff-9d03-abfdcd3f88a5
-
encryption_key
AE82780435B1CCEF85C04A1CA71F0D6403E04CAB
-
install_name
Client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5660-0-0x00007FFAB864F000-0x00007FFAB8650000-memory.dmp
memory/5660-1-0x00000227658A0000-0x0000022765A36000-memory.dmp
memory/5660-2-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-3-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-4-0x0000022700030000-0x000002270004C000-memory.dmp
memory/5660-5-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-6-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-7-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-8-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-9-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-10-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-11-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-12-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-13-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-14-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-15-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-18-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-16-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-17-0x0000022700EC0000-0x0000022700EFA000-memory.dmp
memory/5660-19-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-20-0x0000022765F20000-0x0000022765F70000-memory.dmp
memory/5660-21-0x0000022780040000-0x00000227800F2000-memory.dmp
memory/5660-22-0x0000022700F00000-0x0000022700F4E000-memory.dmp
memory/5660-24-0x0000022700FA0000-0x0000022700FEA000-memory.dmp
memory/5660-25-0x0000022700FF0000-0x000002270101A000-memory.dmp
memory/5660-23-0x0000022700F50000-0x0000022700F9C000-memory.dmp
memory/5660-26-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-27-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp
memory/5660-28-0x00007FFAB84C0000-0x00007FFAB8E64000-memory.dmp