2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat
Size 148KB
Sample260815-js2a6aeg29
SHA256 a532ed81cbad9830cd7e287f37a1df7686f64d18902ff44d45eb6c5f0aca917f
MD5 188de68e2bc74b0200a7998311d34255
SHA1 1ddbd4363f20dc17319e0a3a86e56196037c738b
SHA512 bc07b1c0ef210e9a9cc543d37e80c092160196f388344614bcb7116a2805b55ecfdf37137b3fbb9978c6e296c32cf06c8ef7038d203e7109768646de36498cfb
SSDEEP 3072:gxvlP4LmtmQVP9OJ60pzbSAgiHnLLq9Zz1nFbS:gjWJTPnvq/z1Fb
TLSH
T152E31903E3A315FCD5EBC6348EA35235FB7178959B38A62E1780CF361D25B10EA29B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

detects Windows exceutables potentially bypassing UAC using eventvwr.exe 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat

File Explorer

2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat

.exe 148KB

2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat

IMPHASH 30f064d42510e5b755c0c56053c50454
SHA256 a532ed81cbad9830cd7e287f37a1df7686f64d18902ff44d45eb6c5f0aca917f
MD5 188de68e2bc74b0200a7998311d34255
SHA1 1ddbd4363f20dc17319e0a3a86e56196037c738b
SHA512 bc07b1c0ef210e9a9cc543d37e80c092160196f388344614bcb7116a2805b55ecfdf37137b3fbb9978c6e296c32cf06c8ef7038d203e7109768646de36498cfb
SSDEEP 3072:gxvlP4LmtmQVP9OJ60pzbSAgiHnLLq9Zz1nFbS:gjWJTPnvq/z1Fb
TLSH
T152E31903E3A315FCD5EBC6348EA35235FB7178959B38A62E1780CF361D25B10EA29B15
MD5 SHA1 SHA512 SSDEEP TLSH

Detects ransomware indicator
detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfig2W CheckTokenMembership CloseServiceHandle CreateServiceW CryptAcquireContextW CryptDestroyKey CryptEncrypt CryptExportKey CryptGenKey CryptImportKey CryptReleaseContext CryptSetKeyParam FreeSid LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegDeleteTreeW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider

crypt32

CryptStringToBinaryA CryptUnprotectData

d3d9

Direct3DCreate9

dbghelp

MiniDumpWriteDump

libgcc_s_seh-1

_Unwind_Resume

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDIBits GetStockObject SelectObject

gdiplus

GdiplusShutdown GdiplusStartup

iphlpapi

GetAdaptersInfo

kernel32

Beep CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentVariableW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetTempPathW GetThreadContext GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringW Process32FirstW Process32NextW ReadFile ResetEvent SetEvent SetFileAttributesW SetFilePointer SetFirmwareEnvironmentVariableA SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes MFCreateMediaType MFShutdown MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func fwprintf __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _time64 _wcmdln _wcsicmp _wcstoui64 _wtoi abort atexit calloc exit fprintf fputwc free localeconv malloc memcmp memcpy rand signal srand strerror strlen strncmp strstr system vfprintf wcscpy wcslen wcsstr

ole32

CLSIDFromString CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize

oleaut32

OleLoadPicturePath

libwinpthread-1

pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock

shell32

ShellExecuteW

shlwapi

PathFileExistsW PathFindFileNameW

libsqlite3-0

sqlite3_close sqlite3_column_blob sqlite3_column_bytes sqlite3_column_text sqlite3_finalize sqlite3_open_v2 sqlite3_prepare_v2 sqlite3_step

libstdc++-6

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findEPKcy _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4findERKS4_y _ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6substrEyy _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE3endEv _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE4findEPKwy _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE4findERKS4_y _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE5rfindEPKwy _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6substrEyy _ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7compareERKS4_ _ZNSo5writeEPKcx _ZNSt14basic_ifstreamIcSt11char_traitsIcEE5closeEv _ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode _ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev _ZNSt14basic_ofstreamIcSt11char_traitsIcEE5closeEv _ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1ERKNSt7__cxx1112basic_stringIcS1_SaIcEEESt13_Ios_Openmode _ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev _ZNSt15basic_streambufIcSt11char_traitsIcEE5sgetcEv _ZNSt6chrono3_V212steady_clock3nowEv _ZNSt6thread15_M_start_threadESt10unique_ptrINS_6_StateESt14default_deleteIS1_EEPFvvE _ZNSt6thread4joinEv _ZNSt6thread6_StateD2Ev _ZNSt6thread6detachEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructEyc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendEPKcy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6insertEyPKc _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6insertEyRKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7_S_copyEPcPKcy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERyy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1EOS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_disposeEv _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEyyPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE12_M_constructEyw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE13_M_set_lengthEy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendEPKw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendEPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6appendERKS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6insertEyPKw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6insertEyRKS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6resizeEy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7_S_copyEPwPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7replaceEyyPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7reserveEy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_assignERKS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_createERyy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9push_backEw _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1EOS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEC1ERKS4_ _ZNSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEEC1ERKNS_12basic_stringIwS2_S3_EESt13_Ios_Openmode _ZNSt7__cxx1118basic_stringstreamIwSt11char_traitsIwESaIwEED1Ev _ZSt19__throw_logic_errorPKc _ZSt20__throw_length_errorPKc _ZSt20__throw_system_errori _ZSt9terminatev _ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc _ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZStrsIwSt11char_traitsIwESaIwEERSt13basic_istreamIT_T0_ES7_RNSt7__cxx1112basic_stringIS4_S5_T1_EE _ZTVN10__cxxabiv117__class_type_infoE _ZTVN10__cxxabiv120__si_class_type_infoE _ZdaPv _ZdlPvy _Znay _Znwy __gxx_personality_seh0

urlmon

URLDownloadToFileW

user32

CallNextHookEx ChangeDisplaySettingsW CloseClipboard CreateWindowExW DestroyWindow DispatchMessageW EmptyClipboard EnumDisplaySettingsW ExitWindowsEx FillRect FindWindowW GetClientRect GetClipboardData GetCursorPos GetDC GetDesktopWindow GetKeyboardLayout GetKeyboardState GetLastInputInfo GetSystemMetrics MessageBoxW MsgWaitForMultipleObjects OpenClipboard PeekMessageW ReleaseDC SetClipboardData SetCursorPos SetLayeredWindowAttributes SetWindowTextW SetWindowsHookExW SystemParametersInfoW ToUnicodeEx TranslateMessage UnhookWindowsHookEx

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA

winmm

PlaySoundW waveOutSetVolume

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanGetProfile WlanGetProfileList WlanOpenHandle

ws2_32

InetPtonW WSACleanup WSAStartup accept bind closesocket connect htons listen send sendto setsockopt socket

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_188de68e2bc74b0200a7998311d34255_quasar-rat

advapi32

bcrypt

crypt32

d3d9

dbghelp

libgcc_s_seh-1

gdi32

gdiplus

iphlpapi

kernel32

mf

mfplat

mfreadwrite

msvcrt

ole32

oleaut32

libwinpthread-1

shell32

shlwapi

libsqlite3-0

libstdc++-6

urlmon

user32

winhttp

wininet

winmm

wlanapi

ws2_32

generic