user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Backdoor:MSIL/Quasar!atmn
Backdoor:MSIL/Quasar!atmn - Windows Defender threat signature analysis

Backdoor:MSIL/Quasar!atmn - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Backdoor:MSIL/Quasar!atmn
Classification:
Type:Backdoor
Platform:MSIL
Family:Quasar
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!atmn
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Backdoor - Provides unauthorized remote access for .NET (Microsoft Intermediate Language) platform, family Quasar

Summary:

This is a concrete detection of Quasar RAT, a well-known .NET-based backdoor. This malware provides attackers with complete remote control over the infected system, allowing for data exfiltration, command execution, and establishing persistent access. The technical evidence points to the use of system utilities (PowerShell, Rundll32) and process hooking to maintain its foothold and evade detection.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: 339C6FAFC2880EC71D073A62119624A4.exe
7676fde665253b1ed960e2e444f00c1a27a90cc159350da68624936891a82e38
04/10/2026
→VirusTotal↓Download Sample
Filename: 722de516b97ffae75f478563bcd153487e397d00e5ca9b9c85bec7b1ec307267.exe
722de516b97ffae75f478563bcd153487e397d00e5ca9b9c85bec7b1ec307267
03/10/2026
→VirusTotal↓Download Sample
Filename: WinDefender.exe
bb5cec76a0993cc61f45315e6aea174591fda5df39351b38c1b0552643f73096
25/09/2026
→VirusTotal↓Download Sample
Filename: CBD6A180FBA88121622F18261D3292FC.exe
da1d478a5b6b481e7c66699f8d8f0d21fc7ebbe854401c6ae67eacae6ea5a7a5
12/09/2026
→VirusTotal↓Download Sample
Filename: F6DB29A1C53467F9D613666064785E98.exe
95dc20449c307be8bad1541a3fbf53ee6c9a107f9add5811f744ee33e344b63d
30/08/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate the affected machine from the network to prevent lateral movement. Use your security software to remove the threat. Investigate for persistence mechanisms (e.g., scheduled tasks, registry keys) and change all user and service account passwords associated with the machine. Consider re-imaging the system from a known-good source.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 14/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊