Overview

overview

10

Static

static

10

27/AntiRE.Runtime.dll

windows10-2004-x64

1

27/BouncyC...to.dll

windows10-2004-x64

1

27/Bunifu....ms.dll

windows10-2004-x64

1

27/Bunifu....ck.dll

windows10-2004-x64

1

27/Bunifu....ng.dll

windows10-2004-x64

1

27/Bunifu.....3.dll

windows10-2004-x64

1

27/Bunifu....wn.dll

windows10-2004-x64

1

27/Bunifu....ck.dll

windows10-2004-x64

1

27/Bunifu....ge.dll

windows10-2004-x64

1

27/Bunifu....el.dll

windows10-2004-x64

1

27/Bunifu....ox.dll

windows10-2004-x64

1

27/Bunifu....on.dll

windows10-2004-x64

1

27/Bunifu.... a.dll

windows10-2004-x64

1

27/Bunifu....el.dll

windows10-2004-x64

27/Bunifu....es.dll

windows10-2004-x64

1

27/Bunifu....el.dll

windows10-2004-x64

1

27/Bunifu....ox.dll

windows10-2004-x64

1

27/Bunifu....ar.dll

windows10-2004-x64

1

27/Bunifu....on.dll

windows10-2004-x64

1

27/Bunifu....ng.dll

windows10-2004-x64

1

27/Bunifu....ar.dll

windows10-2004-x64

1

27/Bunifu....or.dll

windows10-2004-x64

1

27/Bunifu....el.dll

windows10-2004-x64

1

27/Bunifu....es.dll

windows10-2004-x64

1

27/Bunifu....er.dll

windows10-2004-x64

1

27/Bunifu....ar.dll

windows10-2004-x64

1

27/ToggleSwitch.dll

windows10-2004-x64

1

27/VenomRe...ck.exe

windows10-2004-x64

1

27/Venombin.exe

windows10-2004-x64

10

27/Vestris...ib.dll

windows10-2004-x64

1

27/cGeoIp.dll

windows10-2004-x64

1

27/client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    90s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2023 15:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    27/client.exe

  • Size

    904KB

  • MD5

    b0e8ff9dd5453104b5b868262fd7a164

  • SHA1

    f33424612617cb6fa9bdc2327c6e70f29d189bd4

  • SHA256

    82f35cefdffb27759bf8665c9b997401c5df88e631531a4fd2cfee456f84246e

  • SHA512

    fee5032e8d5956ed6fcf1d167118a9ac19dd4b251c57689eb5596161c263d84dca62bf1fb708f1dfe9773716943109db93efccabd3db87037cfb95acd3768f1c

  • SSDEEP

    12288:mreLatt+487Ti+XVPJTtnBLF/5DJcTYTTups0MJ2XOtXwlkXbPkooLo:aej487Ti+XVPJTtnBLF/5DJ/lXwlkZf

Score
10/10
quasarspywaretrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    5000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27\client.exe
    "C:\Users\Admin\AppData\Local\Temp\27\client.exe"
    1⤵
      PID:2288

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2288-133-0x0000000000B80000-0x0000000000C68000-memory.dmp
      Filesize

      928KB

      Download
    • memory/2288-134-0x0000000005CC0000-0x0000000006264000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/2288-135-0x0000000005640000-0x00000000056D2000-memory.dmp
      Filesize

      584KB

      Download