Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/08/2026, 04:16
General
- Target Client-built.exe
- Size 2.6MB
- Sample260822-evsdtaeq3w
- SHA256 8abbbd5b09c97b43027817523dbe5cd7450a767150922ed50732d740e5c94560
Malware Config
Extracted
-
quasar
-
1.6.6
-
RATS
-
luije-40835.portmap.host:40835
-
e7635f8e-07f7-4cbb-9645-cc50408defab
-
encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3412-0-0x00007FFE2A8EF000-0x00007FFE2A8F0000-memory.dmp
memory/3412-1-0x000002286F8C0000-0x000002286FB5E000-memory.dmp
memory/3412-2-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-3-0x0000022870040000-0x000002287005E000-memory.dmp
memory/3412-5-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-4-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-6-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-7-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-9-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-8-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-10-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-11-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-12-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-13-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-14-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-15-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-16-0x0000022871B10000-0x0000022871B4A000-memory.dmp
memory/3412-17-0x0000022872280000-0x00000228722D0000-memory.dmp
memory/3412-18-0x0000022873030000-0x00000228730E2000-memory.dmp
memory/3412-19-0x0000022872230000-0x000002287227A000-memory.dmp
memory/3412-20-0x00000228722D0000-0x000002287231E000-memory.dmp
memory/3412-21-0x0000022872320000-0x0000022872346000-memory.dmp
memory/3412-22-0x0000022872350000-0x0000022872384000-memory.dmp
memory/3412-23-0x0000022872390000-0x00000228723DC000-memory.dmp
memory/3412-24-0x00000228730F0000-0x000002287313A000-memory.dmp
memory/3412-25-0x00000228723E0000-0x000002287240A000-memory.dmp
memory/3412-26-0x00007FFE2A760000-0x00007FFE2B104000-memory.dmp
memory/3412-27-0x00000228732F0000-0x0000022873302000-memory.dmp
memory/3412-28-0x0000022873350000-0x000002287338C000-memory.dmp
memory/3412-29-0x00000228732D0000-0x00000228732DA000-memory.dmp
memory/3412-30-0x0000022873320000-0x0000022873328000-memory.dmp