quasar | 25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/06/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c.ps1
Size 1KB
Sample260626-vvka7sc151
SHA256 25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c
MD5 0afe00aa7694327af29efafc15336b82
SHA1 ac623da18f3dbbb71364b29b7a8c212e20b46f91
SHA512 2745163030cf536120768c8e6d601b8523bf50e805524b406dbfa148b3dd1ebfa477753a9a75f8b60e01600caf2cf71d156ef7fa2c083f21da87e22bb1bb5dbe
TLSH
T14F31B7172DBBDEB62041059BBF0E9B591E58A439F2B2C0CFCB5AD9E335290C4C008AD2
MD5 SHA1 SHA512 TLSH

Score

10^/10

newbypassed discovery execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

NewBypassed

91.192.100.36:8084

Mutex

9ce44fed-2881-4998-80a9-a8059346d6d7

Attributes

encryption_key
F2F10A25F4D0D0543F5520C8C8BAC500DA1B1AC1
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Mirsoft Update
subdirectory
Mirsoft

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2544-31-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5624	PowerShell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
6	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5624 set thread context of 2544	5624	PowerShell.exe	92

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5624	PowerShell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CasPol.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5624	PowerShell.exe
5624	PowerShell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5624	PowerShell.exe
Token: SeDebugPrivilege	2544	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2544	CasPol.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 3468	5624	PowerShell.exe	90
PID 3468 wrote to memory of 1696	3468	csc.exe	91
PID 5624 wrote to memory of 2544	5624	PowerShell.exe	92
PID 5624 wrote to memory of 2544	5624	PowerShell.exe	92
PID 5624 wrote to memory of 2544	5624	PowerShell.exe	92
PID 5624 wrote to memory of 2544	5624	PowerShell.exe	92
PID 5624 wrote to memory of 2544	5624	PowerShell.exe	92

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\_25dd129a4822566f38545a37e1120533266fa1a9b895f8605f5b9364744da42c.ps1
1⤵
- Badlisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m1fyghdh\m1fyghdh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCF0.tmp" "c:\Users\Admin\AppData\Local\Temp\m1fyghdh\CSCAAE625D0A5EB482FA18321CE83777679.TMP"
    3⤵
    PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESCCF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESCCF0.tmp
Size 1KB
SHA256 d66f91902f9b12ce7119f7141aa77c167052a128451f5df27e3548ccd4d2ebf8
MD5 ae586766b5b4ab0c413e2526d9decd5d
SHA1 60d8256bb40c20a46741cbda4756938662295070
SHA512 6b6b4e9d74e29d5bfcd3c56c26433495ee88cbce41a04755fdcdfd9c6a76c06d90bb912b6e88d1b837ac6835235b9fa0c4de60ff7c95decdaa99c448844f7b0e
TLSH
T14D21AF0593E9471FF0B757316AF6172F9679FD59EFA2935B854002283C51204EEA0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

m1fyghdh.dll

Path C:\Users\Admin\AppData\Local\Temp\m1fyghdh\m1fyghdh.dll
Size 4KB
SHA256 159d2a6c8bc23d388e147783cf1a9c1433a838668bc157e026f25949ce342629
MD5 5ddc4f2a078d78930ce5f96f99c7f2ff
SHA1 08b5bff2f5b057ba6a2af658e0d6d8ac82fa2a3b
SHA512 62f921100ee3f95c109728e8d02f2bd7bf708bd6a0c78244f8e510f2aac31a1fcbbad886fe8fba54dcb517e026ea22ea0c55eee304287a96904982cd58bfba90
SSDEEP 48:6dnNAVU8o2//MoLEP6swPzVqVVqXiJE5YTtkJxEZK1ulga3sq:gnWou/ePIPzIVMEKeFeK
TLSH
T12F91310667E80EABF0FB07345DB3C72A2674F9E99B63471E0F9442252CAA2500921EB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCAAE625D0A5EB482FA18321CE83777679.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m1fyghdh\CSCAAE625D0A5EB482FA18321CE83777679.TMP
Size 652B
SHA256 0c5f45fd4150f8539f4cb477ce88d670fcf5a7adf12e959865ba444ca5d58525
MD5 d0478bd554396e456a98300f85cf5938
SHA1 34eac5132e92e48d154d73a41183f57d089bfc8f
SHA512 850581e5a3d3e0072bc0762f1d1c2e7035a664e4b6dd61b93d01cef1016f54f774ca56017052ca969e1d4f2c48005970a2575071ef69e015cf4bbfecd442d2af
TLSH
T14DF05E0963F8420EF0F34B30BEF6436795A9BC64DE3393ED184003193C646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m1fyghdh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m1fyghdh\m1fyghdh.0.cs
Size 1KB
SHA256 1682c6e1fab37ea0b97334ccd22dd8687acee96913b774c31af67f3af5af0cea
MD5 c0d230ecbd28ca5f4e7afc2e2edeb53c
SHA1 5d21ff9711800da48e641dd4fb45feb726bd329e
SHA512 af742ebf278a8b6f631314f20f72db364017d88823f2db2680b12a3a3a32061813cb513664a2afb15b1158fdcace770ae90847b97e4880d84236552dea9c95cb
TLSH
T12C21CB540691AE922CD3211C9AD285DAF16780370FBE5D00FDBE36525FDE124D8F968E
MD5 SHA1 SHA512 TLSH

Submit Download

m1fyghdh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m1fyghdh\m1fyghdh.cmdline
Size 369B
SHA256 db947e1e7e843c6aa899e0c18b0c56d4a525f7af1166bb6ca76e977cd12b16a6
MD5 57a16cc21c7cf3543d17ea021aaa6da0
SHA1 53e3c1a1b06dc66f657321d8e806c22798869a06
SHA512 8110d260c5a53d34ba104ee565558c46068aed42a91748396050d2f54daab530b8fe2be889bdc33db77786b5868262d06be4bbb3e3920f7406f1ebd4023dad5e
TLSH
T18CE0683A5646C27D86E9100761A9C4BCC373068B2B407F84648045ADD01700427D17D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2544-40-0x0000000006A10000-0x0000000006AC2000-memory.dmp

Download

memory/2544-38-0x0000000006F70000-0x0000000007588000-memory.dmp

Download

memory/2544-39-0x0000000005750000-0x00000000057A0000-memory.dmp

Download

memory/2544-36-0x00000000052D0000-0x00000000052DA000-memory.dmp

Download

memory/2544-35-0x00000000052E0000-0x0000000005372000-memory.dmp

Download

memory/2544-31-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/2544-34-0x0000000005990000-0x0000000005F4A000-memory.dmp

Download

memory/2544-43-0x0000000007FB0000-0x0000000008016000-memory.dmp

Download

memory/2544-44-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/2544-33-0x0000000074982000-0x0000000074983000-memory.dmp

Download

memory/5624-11-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-22-0x000002BD57350000-0x000002BD57358000-memory.dmp

Download

memory/5624-26-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-27-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-28-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-29-0x000002BD57420000-0x000002BD5742C000-memory.dmp

Download

memory/5624-30-0x000002BD57400000-0x000002BD57410000-memory.dmp

Download

memory/5624-24-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-23-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-25-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-16-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-0-0x00007FFA9D87F000-0x00007FFA9D880000-memory.dmp

Download

memory/5624-37-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-7-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-6-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-5-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download

memory/5624-3-0x000002BD57360000-0x000002BD57382000-memory.dmp

Download

memory/5624-4-0x00007FFA9D6F0000-0x00007FFA9E094000-memory.dmp

Download