Overview

overview

10

Static

static

10

messenger_update.exe

windows10-2004-x64

10

messenger_update.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    59s
  • max time network
    62s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    messenger_update.exe
  • Size 3.1MB
  • Sample260708-ffbyysa16v
  • SHA256 7c859e473180859ae15e6c008a2724e1a1e01ad5e656d7813939927edb605f93
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
pingpingquasarspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • pingping

C2

  • socolive1vn.africa

  • malware.socolive1vn.africa

Mutex

  • dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes
  • encryption_key

    88744B6C5529B458F3F34862830C659732FE5A1C

  • install_name

    molliza.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    malware

  • subdirectory

    malware

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3528
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZkwmIMdZrPcA.bat" "
      2⤵
        PID:3016
        • C:\Windows\system32\chcp.com
          chcp 65001
          3⤵
            PID:4108
          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
            3⤵
              PID:6112
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gGbekxHD8Yrp.bat" "
                4⤵
                  PID:4720
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:5996
                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                      5⤵
                        PID:4212
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UOPjXBVCBtZC.bat" "
                          6⤵
                            PID:1992
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              7⤵
                                PID:5024
                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                7⤵
                                  PID:4404
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Eu90fkn94zLN.bat" "
                                    8⤵
                                      PID:4348
                                      • C:\Windows\system32\chcp.com
                                        chcp 65001
                                        9⤵
                                          PID:1012
                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                          9⤵
                                            PID:5600
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rtRHLryT93pB.bat" "
                                              10⤵
                                                PID:360
                                                • C:\Windows\system32\chcp.com
                                                  chcp 65001
                                                  11⤵
                                                    PID:5032
                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                    11⤵
                                                      PID:1116
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7MqXU4RmqOlH.bat" "
                                                        12⤵
                                                          PID:5728
                                                          • C:\Windows\system32\chcp.com
                                                            chcp 65001
                                                            13⤵
                                                              PID:5472
                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                              13⤵
                                                                PID:3960
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mpy8zXaZ37Fg.bat" "
                                                                  14⤵
                                                                    PID:1400
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      15⤵
                                                                        PID:2052
                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                        15⤵
                                                                          PID:2440
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SqgPq4mRuqMh.bat" "
                                                                            16⤵
                                                                              PID:5960
                                                                              • C:\Windows\system32\chcp.com
                                                                                chcp 65001
                                                                                17⤵
                                                                                  PID:2784
                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                  17⤵
                                                                                    PID:5316
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zXtlEthicTyH.bat" "
                                                                                      18⤵
                                                                                        PID:1680
                                                                                        • C:\Windows\system32\chcp.com
                                                                                          chcp 65001
                                                                                          19⤵
                                                                                            PID:2328
                                                                                          • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                            19⤵
                                                                                              PID:5836
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b3xt7JOHkETz.bat" "
                                                                                                20⤵
                                                                                                  PID:5328
                                                                                                  • C:\Windows\system32\chcp.com
                                                                                                    chcp 65001
                                                                                                    21⤵
                                                                                                      PID:1360
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                      21⤵
                                                                                                        PID:1244
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\op99J83FqV1e.bat" "
                                                                                                          22⤵
                                                                                                            PID:2692
                                                                                                            • C:\Windows\system32\chcp.com
                                                                                                              chcp 65001
                                                                                                              23⤵
                                                                                                                PID:4880
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                23⤵
                                                                                                                  PID:4124
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e6jltO15FluY.bat" "
                                                                                                                    24⤵
                                                                                                                      PID:2400
                                                                                                                      • C:\Windows\system32\chcp.com
                                                                                                                        chcp 65001
                                                                                                                        25⤵
                                                                                                                          PID:5220
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                          25⤵
                                                                                                                            PID:1924
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0TMNIE3cBNy5.bat" "
                                                                                                                              26⤵
                                                                                                                                PID:3100
                                                                                                                                • C:\Windows\system32\chcp.com
                                                                                                                                  chcp 65001
                                                                                                                                  27⤵
                                                                                                                                    PID:4308
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                    27⤵
                                                                                                                                      PID:2920
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q74vPD52HbnX.bat" "
                                                                                                                                        28⤵
                                                                                                                                          PID:5352
                                                                                                                                          • C:\Windows\system32\chcp.com
                                                                                                                                            chcp 65001
                                                                                                                                            29⤵
                                                                                                                                              PID:5348
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                              29⤵
                                                                                                                                                PID:2660
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Atqsc18QKJP9.bat" "
                                                                                                                                                  30⤵
                                                                                                                                                    PID:4764
                                                                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                                                                      chcp 65001
                                                                                                                                                      31⤵
                                                                                                                                                        PID:5260
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                        31⤵
                                                                                                                                                          PID:4468
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d3k7Ru65lbaR.bat" "
                                                                                                                                                            32⤵
                                                                                                                                                              PID:5508
                                                                                                                                                              • C:\Windows\system32\chcp.com
                                                                                                                                                                chcp 65001
                                                                                                                                                                33⤵
                                                                                                                                                                  PID:1936
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
                                                                                                                                                                  33⤵
                                                                                                                                                                    PID:292
                                                                                                  • C:\Windows\system32\sihost.exe
                                                                                                    sihost.exe
                                                                                                    1⤵
                                                                                                      PID:4452
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe /LOADSAVEDWINDOWS
                                                                                                        2⤵
                                                                                                          PID:948

                                                                                                      Network

                                                                                                            MITRE ATT&CK Matrix

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            0TMNIE3cBNy5.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\0TMNIE3cBNy5.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 f50ef52614b543d22e34a31aafb553d19d32e8f7219fd882d53483f6d4a28e5b
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            7MqXU4RmqOlH.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7MqXU4RmqOlH.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 b014af3ccfb78be6bf087c1968aee8eae6d9047d37057aa5804dfe650c7b645e
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            Atqsc18QKJP9.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Atqsc18QKJP9.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 1d090b9fbeb1ea9cd389608656f8e4f27e8567da97642511116a3a2c6ce68af2
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            Eu90fkn94zLN.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Eu90fkn94zLN.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 673a9ed115975e157fffda2c4e196bcd09d522d18042937e133dac186a6ea3bc
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            Mpy8zXaZ37Fg.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Mpy8zXaZ37Fg.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 4bd26b433ce2aa44566e066e4a5c1bac1a826aae7b58e33e20f2c191a772e589
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            Q74vPD52HbnX.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Q74vPD52HbnX.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 398152c8f6ed2b753fc527259eca6b77ebd38b72587506e0a3a5f21425b2ab7d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            SqgPq4mRuqMh.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\SqgPq4mRuqMh.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 a7c02c8f536cba8ef599cabdd1b98fbd6c91cde2706b78d2f5f1a5566b325831
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            UOPjXBVCBtZC.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\UOPjXBVCBtZC.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 2678baab971700b1d906b7e5df00a9f681715ce7dda00b239fe716664f593a89
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            ZkwmIMdZrPcA.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\ZkwmIMdZrPcA.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 4bd924351c6ffe635fd5b883b011b2fb45005d9ed1500964edd8769ddba9de62
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            b3xt7JOHkETz.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\b3xt7JOHkETz.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 2d0eeccf8a895960fdb10801dabc94d17b5e23dc0b37e57eceea9ac84cd8e484
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            d3k7Ru65lbaR.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\d3k7Ru65lbaR.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 dd4e5204898e9eb89e434e073b701756782a15dd1a98ea075dde255b534295ed
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            e6jltO15FluY.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\e6jltO15FluY.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 28a7a18b6e2aba08ee1461df99da737054b82f091cf9ce95e6bc34630196e365
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            gGbekxHD8Yrp.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gGbekxHD8Yrp.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 87b772e496e19829ee70f2490c05cf41f5b9b7285929ed197fc5c725228756d6
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            op99J83FqV1e.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\op99J83FqV1e.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 b71d368356ed121005414fc30b4b62804616eea087b1879ec3ff718dcf557c1f
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            rtRHLryT93pB.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\rtRHLryT93pB.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 da878c4a430d362dd62df4fffd27f4f1eae0c15392d3defa2aec6cb77d1918ac
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            zXtlEthicTyH.bat
                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\zXtlEthicTyH.bat
                                                                                                            • Size 185B
                                                                                                            • SHA256 9ba29eeef40f03eb886501796c368d3f3444fee6bf7e43896aca433b8c34191d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            memory/3528-11-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-9-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-1-0x00000000005A0000-0x00000000008CC000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-2-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-3-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-4-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-5-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-6-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-7-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-8-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-10-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-0-0x00007FFC78EBF000-0x00007FFC78EC0000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-12-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-13-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-14-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/3528-22-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-23-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-28-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-35-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-34-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-33-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-32-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-36-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-30-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-43-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-29-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-31-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-27-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-26-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-25-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download

                                                                                                            memory/6112-24-0x00007FFC78D30000-0x00007FFC796D4000-memory.dmp
                                                                                                            Download