Hello and welcome to the Thursday, June 12, 2025 edition of the Sands Internet Storm Center's Stormcast.

My name is Johannes Ulrich, and this episode brought you by the Sands.edu undergraduate certificate program in Applied Cybersecurity is recorded in Jacksonville, Florida.

Well, in diaries today, we have Xavier looking at yet another image.

This time, it actually leads to the install of a Quasar Remote Admin tool.

Now, it all starts pretty innocuous with a little bad file.

That file will download the actual installer, injector.

It'll also load a normal Word document.

And that's typically done because the user just clicked on something that looked like a

word document.

So after starting the malicious code, the malware loads an actual Word document.

So the user really thinks nothing bad happened.

Well, the second stage then will download this kind of noisy looking image.

This is actually an encrypted, codeable then be injected into the running process

here by the batch file that was downloaded. Also interesting that the second stage being downloaded

relies on environment variables defined by the first stage. That way, if someone would just reverse analyze the second stage without having access

to the first stage, then of course that wouldn't execute, wouldn't actually do anything bad.

For example, like if you would just quickly load that script into sandbox or such by itself, well, it wouldn't

really show up as malicious.

VirusTotal doesn't do

a good job here. I should say

the antivirus tools

beings of represented by

...