Overview

overview

10

Static

static

1

Batch.bat

windows10-2004-x64

10

Batch.bat

windows11-ltsc_2024-x64

10

Resubmissions

20/09/2026, 22:17

260920-17ppcatwfx10

10/08/2026, 21:05

260810-zxal1attby8

Sharing

Copy URL Twitter E-mail

General

  • Target
    Batch.bat
  • Size 894KB
  • Sample260920-17ppcatwfx
  • SHA256 d817ea0af77c55d11377114d7b69cfb0037302c2a06fd89c46aa79e34f1e28cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
quasarshixexecutionmodulepersistenceratspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.7.1

Botnet

  • shix

C2

  • 193.161.193.99:43963

Mutex

  • 1a520c91-1f29-47c2-849c-ef2401e27df8

Attributes
  • encryption_key

    EC1C0E7F70CE8F084C53C6DAE1B656E63DF4314C

  • install_name

    .exe

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • log_directory

    key

  • reconnect_delay

    2967

Targets

    • Target
      Batch.bat
    • Size 894KB
    • SHA256 d817ea0af77c55d11377114d7b69cfb0037302c2a06fd89c46aa79e34f1e28cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    shixexecutionquasarmodulepersistenceratspywaretrojan

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • PulsaRAT library module

      Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

      ratmodule

    • Quasar payload

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks