quasar | 5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4

Analysis

max time kernel
153s
max time network
140s
platform
windows7_x64
resource
win7-en-20211208
submitted
19/02/2022, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4.exe
Size

534KB
MD5

cfd9c6e3328e8553ae573a458850224e
SHA1

b39b8f1443a310f5cc6bb8559ca1194aba9f9b48
SHA256

5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4
SHA512

b6bf58039e0b673db407a8073b1dd908744bf682ca76883bb01b6a71a20b5d47fc39e0a610c95dab1236345a9412484ae330fb02c05ade3ee7093b15262809bb

Score

10^/10

quasar venomrat svchost rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

svchost

narrow-ink.auto.playit.gg:50377

Mutex

VNM_MUTEX_LYc2mMMFlAV9sQbWDZ

Attributes

encryption_key
RlSxUty7h5rPz7eaEnn4
install_name
svhost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost
subdirectory
svhost

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/732-56-0x0000000000330000-0x00000000003BC000-memory.dmp	disable_win_def

Quasar Payload 1 IoCs

resource	yara_rule
behavioral1/memory/732-56-0x0000000000330000-0x00000000003BC000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	732	5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4.exe

C:\Users\Admin\AppData\Local\Temp\5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4.exe
"C:\Users\Admin\AppData\Local\Temp\5b5e82e79c52452b2d03a4fa83b95bbeec8a4b1afd97edd9999a77d26f5488b4.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/732-55-0x0000000074C8E000-0x0000000074C8F000-memory.dmp

Filesize
4KB

Download
memory/732-56-0x0000000000330000-0x00000000003BC000-memory.dmp

Filesize
560KB

Download
memory/732-57-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download