Overview

overview

10

Static

static

10

CraxsRatV3...er.exe

windows7-x64

7

CraxsRatV3...er.exe

windows10-2004-x64

7

CraxsRatV3...er.exe

windows7-x64

1

CraxsRatV3...er.exe

windows10-2004-x64

1

CraxsRatV3...er.exe

windows7-x64

1

CraxsRatV3...er.exe

windows10-2004-x64

1

CraxsRatV3...er.exe

windows7-x64

1

CraxsRatV3...er.exe

windows10-2004-x64

1

CraxsRatV3/cGeoIp.dll

windows7-x64

1

CraxsRatV3/cGeoIp.dll

windows10-2004-x64

1

CraxsRatV3/client.exe

windows7-x64

10

CraxsRatV3/client.exe

windows10-2004-x64

10

CraxsRatV3...rd.dll

windows7-x64

1

CraxsRatV3...rd.dll

windows10-2004-x64

1

CraxsRatV3...ta.exe

windows7-x64

1

CraxsRatV3...ta.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    85s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2023 00:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CraxsRatV3/client.exe

  • Size

    904KB

  • MD5

    b0e8ff9dd5453104b5b868262fd7a164

  • SHA1

    f33424612617cb6fa9bdc2327c6e70f29d189bd4

  • SHA256

    82f35cefdffb27759bf8665c9b997401c5df88e631531a4fd2cfee456f84246e

  • SHA512

    fee5032e8d5956ed6fcf1d167118a9ac19dd4b251c57689eb5596161c263d84dca62bf1fb708f1dfe9773716943109db93efccabd3db87037cfb95acd3768f1c

  • SSDEEP

    12288:mreLatt+487Ti+XVPJTtnBLF/5DJcTYTTups0MJ2XOtXwlkXbPkooLo:aej487Ti+XVPJTtnBLF/5DJ/lXwlkZf

Score
10/10
quasarspywaretrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    5000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CraxsRatV3\client.exe
    "C:\Users\Admin\AppData\Local\Temp\CraxsRatV3\client.exe"
    1⤵
      PID:2304

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2304-133-0x0000000000E40000-0x0000000000F28000-memory.dmp

      Filesize

      928KB

      Download

    • memory/2304-134-0x0000000005F00000-0x00000000064A4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2304-135-0x00000000059F0000-0x0000000005A82000-memory.dmp

      Filesize

      584KB

      Download