quasar | e5aa35d2480e58e2b63e14ef64374728d931423cd3f530cb43a107ca4c2a93aa

Analysis

max time kernel
33s
max time network
151s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21-09-2023 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

990e4a37aa2c639c582f884fd3430063.exe
Size

1.4MB
MD5

990e4a37aa2c639c582f884fd3430063
SHA1

7b272d8dbead6130f66d6c66b3c9d80d24a4486e
SHA256

e5aa35d2480e58e2b63e14ef64374728d931423cd3f530cb43a107ca4c2a93aa
SHA512

5c1a590cdc3e7beecc0d48f74f417ab4c40afdbab90e02240979a0ffcb86e0f284784857c286d291a2334071d58e1c20a19d7c5bf15bdc59e398e26d3c290748
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/1728-144-0x0000000000090000-0x00000000000EE000-memory.dmp	family_quasar
behavioral1/memory/1728-143-0x0000000000090000-0x00000000000EE000-memory.dmp	family_quasar
behavioral1/memory/2496-154-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2496-156-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2496-155-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2496-159-0x0000000004960000-0x00000000049A0000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2072	netsh.exe
2880	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000e0000000122e4-79.dat	acprotect
behavioral1/files/0x000e0000000122e4-78.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2296	7z.exe

Loads dropped DLL 3 IoCs

pid	Process
3068	cmd.exe
3068	cmd.exe
2296	7z.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001c00000001276a-75.dat	upx
behavioral1/files/0x000e0000000122e4-79.dat	upx
behavioral1/files/0x000e0000000122e4-78.dat	upx
behavioral1/files/0x001c00000001276a-76.dat	upx
behavioral1/memory/3068-74-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x001c00000001276a-73.dat	upx
behavioral1/files/0x001c00000001276a-72.dat	upx
behavioral1/memory/2296-81-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/2296-83-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2296-86-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/2296-89-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1904-101-0x00000000022C0000-0x0000000002300000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
2292	PING.EXE
2256	PING.EXE
608	PING.EXE
1660	PING.EXE
3008	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2740	powershell.exe
2992	powershell.exe
2040	powershell.exe
568	powershell.exe
3044	powershell.exe
1904	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2632	WMIC.exe
Token: SeSecurityPrivilege	2632	WMIC.exe
Token: SeTakeOwnershipPrivilege	2632	WMIC.exe
Token: SeLoadDriverPrivilege	2632	WMIC.exe
Token: SeSystemProfilePrivilege	2632	WMIC.exe
Token: SeSystemtimePrivilege	2632	WMIC.exe
Token: SeProfSingleProcessPrivilege	2632	WMIC.exe
Token: SeIncBasePriorityPrivilege	2632	WMIC.exe
Token: SeCreatePagefilePrivilege	2632	WMIC.exe
Token: SeBackupPrivilege	2632	WMIC.exe
Token: SeRestorePrivilege	2632	WMIC.exe
Token: SeShutdownPrivilege	2632	WMIC.exe
Token: SeDebugPrivilege	2632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2632	WMIC.exe
Token: SeRemoteShutdownPrivilege	2632	WMIC.exe
Token: SeUndockPrivilege	2632	WMIC.exe
Token: SeManageVolumePrivilege	2632	WMIC.exe
Token: 33	2632	WMIC.exe
Token: 34	2632	WMIC.exe
Token: 35	2632	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2632	WMIC.exe
Token: SeSecurityPrivilege	2632	WMIC.exe
Token: SeTakeOwnershipPrivilege	2632	WMIC.exe
Token: SeLoadDriverPrivilege	2632	WMIC.exe
Token: SeSystemProfilePrivilege	2632	WMIC.exe
Token: SeSystemtimePrivilege	2632	WMIC.exe
Token: SeProfSingleProcessPrivilege	2632	WMIC.exe
Token: SeIncBasePriorityPrivilege	2632	WMIC.exe
Token: SeCreatePagefilePrivilege	2632	WMIC.exe
Token: SeBackupPrivilege	2632	WMIC.exe
Token: SeRestorePrivilege	2632	WMIC.exe
Token: SeShutdownPrivilege	2632	WMIC.exe
Token: SeDebugPrivilege	2632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2632	WMIC.exe
Token: SeRemoteShutdownPrivilege	2632	WMIC.exe
Token: SeUndockPrivilege	2632	WMIC.exe
Token: SeManageVolumePrivilege	2632	WMIC.exe
Token: 33	2632	WMIC.exe
Token: 34	2632	WMIC.exe
Token: 35	2632	WMIC.exe
Token: SeDebugPrivilege	2740	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3068	1496	990e4a37aa2c639c582f884fd3430063.exe	28
PID 1496 wrote to memory of 3068	1496	990e4a37aa2c639c582f884fd3430063.exe	28
PID 1496 wrote to memory of 3068	1496	990e4a37aa2c639c582f884fd3430063.exe	28
PID 1496 wrote to memory of 3068	1496	990e4a37aa2c639c582f884fd3430063.exe	28
PID 3068 wrote to memory of 2732	3068	cmd.exe	30
PID 3068 wrote to memory of 2732	3068	cmd.exe	30
PID 3068 wrote to memory of 2732	3068	cmd.exe	30
PID 3068 wrote to memory of 2732	3068	cmd.exe	30
PID 2732 wrote to memory of 2876	2732	cmd.exe	31
PID 2732 wrote to memory of 2876	2732	cmd.exe	31
PID 2732 wrote to memory of 2876	2732	cmd.exe	31
PID 2732 wrote to memory of 2876	2732	cmd.exe	31
PID 3068 wrote to memory of 2600	3068	cmd.exe	32
PID 3068 wrote to memory of 2600	3068	cmd.exe	32
PID 3068 wrote to memory of 2600	3068	cmd.exe	32
PID 3068 wrote to memory of 2600	3068	cmd.exe	32
PID 2600 wrote to memory of 2632	2600	cmd.exe	33
PID 2600 wrote to memory of 2632	2600	cmd.exe	33
PID 2600 wrote to memory of 2632	2600	cmd.exe	33
PID 2600 wrote to memory of 2632	2600	cmd.exe	33
PID 3068 wrote to memory of 2740	3068	cmd.exe	35
PID 3068 wrote to memory of 2740	3068	cmd.exe	35
PID 3068 wrote to memory of 2740	3068	cmd.exe	35
PID 3068 wrote to memory of 2740	3068	cmd.exe	35
PID 3068 wrote to memory of 2992	3068	cmd.exe	36
PID 3068 wrote to memory of 2992	3068	cmd.exe	36
PID 3068 wrote to memory of 2992	3068	cmd.exe	36
PID 3068 wrote to memory of 2992	3068	cmd.exe	36
PID 3068 wrote to memory of 2040	3068	cmd.exe	37
PID 3068 wrote to memory of 2040	3068	cmd.exe	37
PID 3068 wrote to memory of 2040	3068	cmd.exe	37
PID 3068 wrote to memory of 2040	3068	cmd.exe	37
PID 3068 wrote to memory of 568	3068	cmd.exe	38
PID 3068 wrote to memory of 568	3068	cmd.exe	38
PID 3068 wrote to memory of 568	3068	cmd.exe	38
PID 3068 wrote to memory of 568	3068	cmd.exe	38
PID 3068 wrote to memory of 3044	3068	cmd.exe	39
PID 3068 wrote to memory of 3044	3068	cmd.exe	39
PID 3068 wrote to memory of 3044	3068	cmd.exe	39
PID 3068 wrote to memory of 3044	3068	cmd.exe	39
PID 3068 wrote to memory of 2296	3068	cmd.exe	40
PID 3068 wrote to memory of 2296	3068	cmd.exe	40
PID 3068 wrote to memory of 2296	3068	cmd.exe	40
PID 3068 wrote to memory of 2296	3068	cmd.exe	40
PID 3068 wrote to memory of 1904	3068	cmd.exe	41
PID 3068 wrote to memory of 1904	3068	cmd.exe	41
PID 3068 wrote to memory of 1904	3068	cmd.exe	41
PID 3068 wrote to memory of 1904	3068	cmd.exe	41
PID 1904 wrote to memory of 2072	1904	powershell.exe	44
PID 1904 wrote to memory of 2072	1904	powershell.exe	44
PID 1904 wrote to memory of 2072	1904	powershell.exe	44
PID 1904 wrote to memory of 2072	1904	powershell.exe	44
PID 1904 wrote to memory of 2880	1904	powershell.exe	45
PID 1904 wrote to memory of 2880	1904	powershell.exe	45
PID 1904 wrote to memory of 2880	1904	powershell.exe	45
PID 1904 wrote to memory of 2880	1904	powershell.exe	45

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\990e4a37aa2c639c582f884fd3430063.exe
"C:\Users\Admin\AppData\Local\Temp\990e4a37aa2c639c582f884fd3430063.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2072
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2880
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1732
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="ZWKQHIWB" set AutomaticManagedPagefile=False
        5⤵
        
        PID:1112
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2380
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:2360
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1128
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:1084
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1740
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        6⤵
        Runs ping.exe
        
        PID:608
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:1708
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 8 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 8 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2088
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        6⤵
        Runs ping.exe
        
        PID:1660
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:1768
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 9 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:2052
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 9
        5⤵
        Runs ping.exe
        
        PID:3008
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2868
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 16 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 16 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:1760
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 16
        5⤵
        Runs ping.exe
        
        PID:2256
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2848
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:1728
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2496

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 16
1⤵
- Runs ping.exe
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
116.9MB

MD5
413150a37a63d28f334d49d75ccd27ff

SHA1
22eb3bae1f34fc25c578e73face760567a51dca5

SHA256
19720adb0d057dded801b6ff7b50b7f663c863c288805bcf91b306a8f32508d6

SHA512
9f4573a5efa06f8ee157b587c675317364afc1b77380553216785db29bb9f51022b1236aedb12601e20194e10b5d29a134d3cf9153c4e0cf5c0091128a027038

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
119.9MB

MD5
ae6057491da372b1fb49a7c893d62d8c

SHA1
195bf6224723527779a70885e8974985a72de6bf

SHA256
0ebb06ae4eaeda2e351753ca3085ea95bab53e93e8cbe7a873113130a09f953c

SHA512
767f59c55e2aba34c280cddceb7b17712a34c682852fc581bee38ee1de665af41b0fc87eb3cb3462536c59546adecde688897ba37a3c2272858770f17272186d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
115.8MB

MD5
c067cbe0efcdadcf39456ea7f7e1444e

SHA1
3174fcfcc4eaa194808f3f6b1ceba1c55cefd52e

SHA256
2ffed517a5f59e7990945dd79ce3d5959b748583ab1c1bfd92a034c20e400d5b

SHA512
6288ee325ebf3a4f3dc9ec085a85d8853b1f9193a608292fa720c77f825fec435d8ea086f654c93a1b088a6d7e451448519aac66911a62b860057b9c484e9c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
206.6MB

MD5
3591cfe1432f6c1cb909cf483b9c4691

SHA1
56451db87c22c63f05d56f758ae6407fef51d10f

SHA256
f205634b09d110a962a04d69a6a9dfa15b0f6e408ab49b331509112dbc485cdd

SHA512
6d11ad313efbcc75e36dc868c4286a16d5a089155e530e509733239cc3ab3a0be58190b037b61c48b7f3d9a1c1432332913bd604761be9844c144df8f983a8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I1ZQEUWYV9IL6H3Q6EC0.temp

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
63ace75064ccbc3cd5dae8f94e6d1ad8

SHA1
64ebe54c9efdc31fa1b5d9150ad16e5252547baa

SHA256
6aea3d4f27d5b6d0f7734d07d370c8aa9a569bddc635e4ccca087941e94f6883

SHA512
76c3478b7c322358e62f586a398173b07bc19f588c8d512f7e057a7962815606e0f029d1c0b9b11eb808a56a4e0955897664a54fe5048f1b69cb4b3a0be79cc4

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
76.6MB

MD5
bb5b5618c4e91fb492e8c3dd5cd19368

SHA1
5d05d13083f5b36dcbd539232cdd4a45e396fd28

SHA256
6691d04d37a6ba11b99f2db806bceb00b4e171a3936f5fd11d62d122e7e554a8

SHA512
e28847e555272c45196c87584b7a5ecc29733cf59153c38ab735bfe9bfdcfed8f5357041ea0c5139f8a73e674af7ba004bde964e6d507e069a81faea59589860

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
50.9MB

MD5
fc21de15f063884edef049d7ecf58dc5

SHA1
648644c4f0aebc7c37ff4aa8e6fb86cf3b1850ee

SHA256
85368513838840a176a565f77ab72501c59ee203f6675829daf02c3969424c73

SHA512
24d5f5b4f843c62f001f9c529dd805859e9bb577761f020fd9252d9b0201fc3a99ed6cd2b7351ad4dd728a2d2b5d3023d79a9610b5d9199518721728b0ad2b66

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
52.3MB

MD5
e5acb4fc4859c11a73e059a6ba5f25d2

SHA1
96515f4e41a85ab093fbea6f9c06f6aff566a20d

SHA256
2a175a1bec5b7025a8ac753d4151646954a2705d60a270e68ec169df83dad7b9

SHA512
082d8b37dc66afa122c8539d4ce9a5cbaa6dc8cabc651f8533cd3f792892253245a37d53875785635b0e3941dd6d2348f760d62c49907403d97f72148ad67939

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
120.4MB

MD5
01dc0d70b5ae72022657f5ffd3eb2d25

SHA1
3e16fb94e6314d888e55293aea8e8ca7bb86e28e

SHA256
5ea43d7391cfa63b84b28eed0d36073e31c239d564661f5655d17492cc75ef55

SHA512
7cf548dfdefffd07fc06791db8bbfbf35dbee6019ec94818f541f95da23316e3123913ddb2e138c436d895ee4ab2d738f95df0d99172abefde415085dd559857

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
119.1MB

MD5
bc09e0309b0c3799aeab077d31c1f8e4

SHA1
f5f66bcbe2e8035272e4c44275d773aa58e22ba1

SHA256
cd82731343a8e843ce74f79f53f59a6eb1363e3c67c62daa87567f251809d480

SHA512
8eaa8d6ad902eb564705d1aee1ea9b49ee79502f2fda15d41bbbded0372d1cb6295732f0dff02033c8be98ce74a1041d5107012603ae0487f01913eafd1e73e7

Download Submit
\Users\Admin\Music\rot.exe

Filesize
52.2MB

MD5
9775becfa039147791bdb53723c2c473

SHA1
00ef5d6b1fd332036e169be8a3ca1f4901decb11

SHA256
affa6a6e92256dd5b95b4bc68eafa46a15dc14c9d01fffe994523bdccf2d79c8

SHA512
ecc4496c552850a464e837371fc5b0ddeb5a95647a1935aed1aca2fdb622e92680e6d143365a26c6c0a7f6b65fe2cff264499e1ef6db675c789d92e924d74d75

Download Submit
memory/568-56-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/568-59-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/568-55-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/568-57-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/568-58-0x00000000026D0000-0x0000000002710000-memory.dmp

Filesize
256KB

Download
memory/568-60-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/1084-122-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1084-109-0x0000000001250000-0x0000000001406000-memory.dmp

Filesize
1.7MB

Download
memory/1084-113-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1084-119-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1084-117-0x0000000000BB0000-0x0000000000BF0000-memory.dmp

Filesize
256KB

Download
memory/1728-139-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/1728-143-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/1728-141-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/1728-144-0x0000000000090000-0x00000000000EE000-memory.dmp

Filesize
376KB

Download
memory/1728-145-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1768-123-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-118-0x0000000000390000-0x00000000003D6000-memory.dmp

Filesize
280KB

Download
memory/1768-116-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/1768-115-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-114-0x00000000001C0000-0x0000000000376000-memory.dmp

Filesize
1.7MB

Download
memory/1768-120-0x00000000707A0000-0x0000000070E8E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-121-0x0000000004D20000-0x0000000004D60000-memory.dmp

Filesize
256KB

Download
memory/1904-108-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/1904-99-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/1904-100-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/1904-101-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/1904-103-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/1904-102-0x00000000022C0000-0x0000000002300000-memory.dmp

Filesize
256KB

Download
memory/2040-46-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-47-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-49-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-48-0x00000000021E0000-0x0000000002220000-memory.dmp

Filesize
256KB

Download
memory/2296-89-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2296-83-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2296-86-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2296-81-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2496-158-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2496-156-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2496-155-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2496-159-0x0000000004960000-0x00000000049A0000-memory.dmp

Filesize
256KB

Download
memory/2496-154-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2496-161-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2740-30-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-29-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2740-26-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-27-0x00000000744A0000-0x0000000074A4B000-memory.dmp

Filesize
5.7MB

Download
memory/2740-28-0x00000000002B0000-0x00000000002F0000-memory.dmp

Filesize
256KB

Download
memory/2848-136-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/2848-137-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2848-157-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-153-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2848-138-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2848-131-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-132-0x00000000001F0000-0x00000000003A6000-memory.dmp

Filesize
1.7MB

Download
memory/2848-133-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2848-134-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2848-135-0x0000000000A80000-0x0000000000A9A000-memory.dmp

Filesize
104KB

Download
memory/2992-39-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/2992-38-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/2992-36-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-37-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/2992-40-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-67-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-66-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-71-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/3044-68-0x0000000002780000-0x00000000027C0000-memory.dmp

Filesize
256KB

Download
memory/3044-70-0x0000000002780000-0x00000000027C0000-memory.dmp

Filesize
256KB

Download
memory/3044-69-0x0000000002780000-0x00000000027C0000-memory.dmp

Filesize
256KB

Download
memory/3068-84-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3068-82-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3068-74-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3068-112-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3068-77-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download