{
  "Event": {
    "uuid": "8975ee88-1a24-52cc-8c39-74ddf2741efb",
    "info": "Quasar + XWorm + PowerShell",
    "date": "2025-10-10",
    "threat_level_id": 2,
    "analysis": 2,
    "timestamp": 1791700330,
    "publish_timestamp": 1791700330,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"RAT\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Loader\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"PowerShell\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Evasion\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1685\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "97e83fbe-0aa9-5652-a2e1-d9f66033d8fc",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/quasar-xworm-powershell-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791700330
      },
      {
        "uuid": "b2074e8f-5dfe-52b5-9fce-87f5cce9e518",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/quasar-xworm-powershell.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791700330
      },
      {
        "uuid": "cb72e7e7-fc23-5bc5-afa6-e54bb7ed29e5",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/quasar-xworm-powershell/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791700330
      },
      {
        "uuid": "2a0640f4-1478-552e-b609-db5c09cbdb11",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/quasar-xworm-powershell.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791700330
      },
      {
        "uuid": "de8cb6f0-3b5e-5fcf-9a15-ddc818f57b33",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: VBScript-Spawned PowerShell In-Memory Payload Download\nid: ea533822-dc1e-40c2-8f04-e3742393c93e\nstatus: experimental\ndescription: >-\n  Detects a PowerShell process spawned by wscript.exe that uses .NET\n  HttpClient calls to download a payload disguised as an image file,\n  consistent with the QuasarRAT/Xworm PowerShell loader chain. Broadly\n  scoped — an analyst should triage the hits and confirm against the\n  campaign's payload-URL and C2 indicators in the IOC feed.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/quasar-xworm-powershell-detections/\nauthor: The Hunters Ledger\ndate: '2025-10-17'\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.command-and-control\n    - attack.t1105\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\wscript.exe'\n        Image|endswith: '\\powershell.exe'\n        CommandLine|contains|all:\n            - 'System.Net.Http.HttpClient'\n            - 'GetAsync'\n            - 'update.png'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate administrative or software-deployment scripts that\n      launch PowerShell from a Windows Script Host wrapper and fetch\n      content over HTTP\n    - Internal automation that uses .NET HttpClient from PowerShell to download update artifacts\nlevel: medium",
        "to_ids": false,
        "comment": "VBScript-Spawned PowerShell In-Memory Payload Download | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1059.001, T1105 | rule hash 09ebd1e5 | https://the-hunters-ledger.com/hunting-detections/quasar-xworm-powershell-detections/",
        "timestamp": 1791700330,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "0a6c1632-7917-577c-b531-65569be91eba",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: QuasarRAT / Xworm PowerShell Loader\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule PS_Defender_Exclusion_Quasar_Xworm {\n   meta:\n      description = \"Detects a file containing all of Add-MpPreference, -ExclusionPath, -ExclusionProcess and the build-specific string update.png (any case, ASCII or UTF-16), the Defender exclusion step of the QuasarRAT/Xworm PowerShell loader campaign; the report records exclusions for the C:\\\\ drive and the processes powershell.exe, wscript.exe, cmd.exe and cvtres.exe, which the rule does not test\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/quasar-xworm-powershell-detections/\"\n      date = \"2025-10-17\"\n      hash1 = \"4ae132de21ab60da7d562f4c2d1f6d26650bbc0c80c542537bc7eb973d05f127\"\n      hash2 = \"153a6d225dffd61913f37ac68d19eb61c1c35374f03b9f94faf28a9bb16ede4b\"\n      family = \"QuasarRAT/Xworm\"\n      malware_type = \"Loader\"\n      campaign = \"QuasarRAT-Xworm-PowerShell-Loader-193.233.164.21\"\n      id = \"31039cfb-dcf2-4e86-87c2-bf063031b16e\"\n   strings:\n      $a = \"Add-MpPreference\" ascii wide nocase\n      $b = \"-ExclusionPath\" ascii wide nocase\n      $c = \"-ExclusionProcess\" ascii wide nocase\n      $d = \"update.png\" ascii wide nocase\n   condition:\n      all of them\n}",
        "to_ids": false,
        "comment": "PowerShell Defender Exclusion Script Naming update.png | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1685 | rule hash 90001df6 | https://the-hunters-ledger.com/hunting-detections/quasar-xworm-powershell-detections/",
        "timestamp": 1791700330,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}