Analysis
- user interaction
yes - max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
24/06/2026, 18:05
General
- Target Pulsar-Client.exe
- Size 952KB
- Sample260624-wn9syses8n
- SHA256 3e1fb3b7afe226fa78259f1b8c889d9cc92f544e6e25eb7778409cbdc59a7a8b
Malware Config
Extracted
-
quasar
-
encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\Pulsar-Client.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3192-0-0x00007FFC911BF000-0x00007FFC911C0000-memory.dmp
memory/3192-1-0x000001D41DAC0000-0x000001D41DBB4000-memory.dmp
memory/3192-2-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-3-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-4-0x000001D41E090000-0x000001D41E0C4000-memory.dmp
memory/3192-6-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-5-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-7-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-8-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-9-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-10-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-11-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-12-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-13-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-14-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-15-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-16-0x000001D41FAA0000-0x000001D41FADE000-memory.dmp
memory/3192-17-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/3192-18-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp