quasar | 863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e

Analysis

max time kernel
46s
max time network
161s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe
Size

1.4MB
MD5

0dad74135677936499c2ff723c0a9712
SHA1

37897e154481cd6634527afd05731f6eccc9dd64
SHA256

863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e
SHA512

3a01cf85838f62ce1a73642079f747be292507d395cbf786e912da47986024a447479c2ebc9dc5d05884741f159b0582bf79d1e2eb16a6e9e51d54590b6b7c07
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/2056-139-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2056-140-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2056-143-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2056-146-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2056-144-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2356	netsh.exe
2916	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00360000000155fd-76.dat	acprotect
behavioral1/files/0x00360000000155fd-75.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1984	7z.exe

Loads dropped DLL 3 IoCs

pid	Process
2596	cmd.exe
2596	cmd.exe
1984	7z.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015c24-69.dat	upx
behavioral1/files/0x00360000000155fd-76.dat	upx
behavioral1/files/0x00360000000155fd-75.dat	upx
behavioral1/memory/1984-77-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x0009000000015c24-73.dat	upx
behavioral1/files/0x0009000000015c24-72.dat	upx
behavioral1/memory/2596-71-0x00000000001D0000-0x0000000000202000-memory.dmp	upx
behavioral1/files/0x0009000000015c24-70.dat	upx
behavioral1/memory/1984-80-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1984-86-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/2228-97-0x0000000002810000-0x0000000002850000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
908	PING.EXE
1800	PING.EXE
108	PING.EXE
1520	PING.EXE
2052	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2024	powershell.exe
524	powershell.exe
1100	powershell.exe
1172	powershell.exe
2404	powershell.exe
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe
Token: SeUndockPrivilege	2588	WMIC.exe
Token: SeManageVolumePrivilege	2588	WMIC.exe
Token: 33	2588	WMIC.exe
Token: 34	2588	WMIC.exe
Token: 35	2588	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2588	WMIC.exe
Token: SeSecurityPrivilege	2588	WMIC.exe
Token: SeTakeOwnershipPrivilege	2588	WMIC.exe
Token: SeLoadDriverPrivilege	2588	WMIC.exe
Token: SeSystemProfilePrivilege	2588	WMIC.exe
Token: SeSystemtimePrivilege	2588	WMIC.exe
Token: SeProfSingleProcessPrivilege	2588	WMIC.exe
Token: SeIncBasePriorityPrivilege	2588	WMIC.exe
Token: SeCreatePagefilePrivilege	2588	WMIC.exe
Token: SeBackupPrivilege	2588	WMIC.exe
Token: SeRestorePrivilege	2588	WMIC.exe
Token: SeShutdownPrivilege	2588	WMIC.exe
Token: SeDebugPrivilege	2588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2588	WMIC.exe
Token: SeRemoteShutdownPrivilege	2588	WMIC.exe
Token: SeUndockPrivilege	2588	WMIC.exe
Token: SeManageVolumePrivilege	2588	WMIC.exe
Token: 33	2588	WMIC.exe
Token: 34	2588	WMIC.exe
Token: 35	2588	WMIC.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2596	2732	863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe	28
PID 2732 wrote to memory of 2596	2732	863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe	28
PID 2732 wrote to memory of 2596	2732	863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe	28
PID 2732 wrote to memory of 2596	2732	863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe	28
PID 2596 wrote to memory of 2460	2596	cmd.exe	30
PID 2596 wrote to memory of 2460	2596	cmd.exe	30
PID 2596 wrote to memory of 2460	2596	cmd.exe	30
PID 2596 wrote to memory of 2460	2596	cmd.exe	30
PID 2460 wrote to memory of 1632	2460	cmd.exe	31
PID 2460 wrote to memory of 1632	2460	cmd.exe	31
PID 2460 wrote to memory of 1632	2460	cmd.exe	31
PID 2460 wrote to memory of 1632	2460	cmd.exe	31
PID 2596 wrote to memory of 1728	2596	cmd.exe	32
PID 2596 wrote to memory of 1728	2596	cmd.exe	32
PID 2596 wrote to memory of 1728	2596	cmd.exe	32
PID 2596 wrote to memory of 1728	2596	cmd.exe	32
PID 1728 wrote to memory of 2588	1728	cmd.exe	33
PID 1728 wrote to memory of 2588	1728	cmd.exe	33
PID 1728 wrote to memory of 2588	1728	cmd.exe	33
PID 1728 wrote to memory of 2588	1728	cmd.exe	33
PID 2596 wrote to memory of 2024	2596	cmd.exe	35
PID 2596 wrote to memory of 2024	2596	cmd.exe	35
PID 2596 wrote to memory of 2024	2596	cmd.exe	35
PID 2596 wrote to memory of 2024	2596	cmd.exe	35
PID 2596 wrote to memory of 524	2596	cmd.exe	36
PID 2596 wrote to memory of 524	2596	cmd.exe	36
PID 2596 wrote to memory of 524	2596	cmd.exe	36
PID 2596 wrote to memory of 524	2596	cmd.exe	36
PID 2596 wrote to memory of 1100	2596	cmd.exe	37
PID 2596 wrote to memory of 1100	2596	cmd.exe	37
PID 2596 wrote to memory of 1100	2596	cmd.exe	37
PID 2596 wrote to memory of 1100	2596	cmd.exe	37
PID 2596 wrote to memory of 1172	2596	cmd.exe	38
PID 2596 wrote to memory of 1172	2596	cmd.exe	38
PID 2596 wrote to memory of 1172	2596	cmd.exe	38
PID 2596 wrote to memory of 1172	2596	cmd.exe	38
PID 2596 wrote to memory of 2404	2596	cmd.exe	39
PID 2596 wrote to memory of 2404	2596	cmd.exe	39
PID 2596 wrote to memory of 2404	2596	cmd.exe	39
PID 2596 wrote to memory of 2404	2596	cmd.exe	39
PID 2596 wrote to memory of 1984	2596	cmd.exe	40
PID 2596 wrote to memory of 1984	2596	cmd.exe	40
PID 2596 wrote to memory of 1984	2596	cmd.exe	40
PID 2596 wrote to memory of 1984	2596	cmd.exe	40
PID 2596 wrote to memory of 2228	2596	cmd.exe	43
PID 2596 wrote to memory of 2228	2596	cmd.exe	43
PID 2596 wrote to memory of 2228	2596	cmd.exe	43
PID 2596 wrote to memory of 2228	2596	cmd.exe	43
PID 2228 wrote to memory of 2356	2228	powershell.exe	44
PID 2228 wrote to memory of 2356	2228	powershell.exe	44
PID 2228 wrote to memory of 2356	2228	powershell.exe	44
PID 2228 wrote to memory of 2356	2228	powershell.exe	44
PID 2228 wrote to memory of 2916	2228	powershell.exe	45
PID 2228 wrote to memory of 2916	2228	powershell.exe	45
PID 2228 wrote to memory of 2916	2228	powershell.exe	45
PID 2228 wrote to memory of 2916	2228	powershell.exe	45

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1852	attrib.exe

C:\Users\Admin\AppData\Local\Temp\863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe
"C:\Users\Admin\AppData\Local\Temp\863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2356
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2916
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2088
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="ZWKQHIWB" set AutomaticManagedPagefile=False
        5⤵
        
        PID:1884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1396
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:3032
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1852
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:1280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2044
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        6⤵
        Runs ping.exe
        
        PID:908
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:704
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        6⤵
        Runs ping.exe
        
        PID:1800
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:3056
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        5⤵
        Runs ping.exe
        
        PID:108
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2260
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:2364
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 12
        5⤵
        Runs ping.exe
        
        PID:2052
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1524
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2056

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 12
1⤵
- Runs ping.exe
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
147.4MB

MD5
8adcab89a3a0ef382180ddc67a7feffa

SHA1
331b17f68a187b660bab77b6a5474670d0500abc

SHA256
75fc5ee5a9506087b3533b4a2d1d6d03327c73ba85ac783b43cc883f60c62e23

SHA512
416814dc661b8a1b47eb6336b1ae335ab735c920049015cdfc1bea205d7656ddafa880a6045bb0c5e352463539404ffb5c4d4ed57953c8e22024a11d671f4d7f

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
148.1MB

MD5
5a2e415f054f9319d68b17233dc1a26e

SHA1
0e929f1de39be2275675a68c5e0239134b8c6206

SHA256
9d9fc21b4ffc4ca5ec17a939cd53dc99f3690ac176763dcc3aefd392cf6ed01f

SHA512
0acca6e391d5e8690911129e35708cc496dde477b0a7a799bc107e88a4320169be3c33684611efdcd8d68e79da6294a7ad473d5a5b0da409337921ba301ad60e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
155.4MB

MD5
48032fd1fa1e649e6dffdd9d5fe4a7d8

SHA1
16368230e82439ec3741f9ba19fe848b50b25802

SHA256
a984322fed40f22e915ce887125f6e788fa8a2e18180bde32e38cdf810b617bb

SHA512
94fc3b9d851c4d3d1eef578fce1f501c64322785d583e5e116e00a869cffd325dc04c314e4ae51128b0f50842eb02000bb529ce3611e8849f60f96f5c017fa36

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
257.2MB

MD5
00ffb80f75215e6833bc6beccbc435eb

SHA1
2e3e1afaaf29d730d20d8c6736e4c8fec350dd3f

SHA256
5ddd15b6b9e0a0ed8e00a72b0479f1345d53c7c2d21d47fd1e07bc4e66d44851

SHA512
a02ecafe2d516cabff1337d557f7a0f60e3b7f55c92cff77687738dabc6bf6be0d5c8984d69b377bfc90fd1f700e74d6639630f503b4d9e4458289c3c180bec8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M2IS9NMV8NXIMEB3HXQ2.temp

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
65a88459a17f79250f3865545e8b71fe

SHA1
0298949d9aae99d43065cf6643c4a5bc0f28a297

SHA256
87b440f7bb9cd61534a23052ed5e549a7f1d41da8faea78251bd9a3eb424c7c8

SHA512
bf9411b0beeb9c4e824001fd7eb52b1d3586276265f7fded64e425348f54913cd4f95ff493730bc1f80d1f80759e497ed563bd47728c6b3e77ec6fcfe91e4497

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
89.4MB

MD5
7ae0cb101d6d5ad2fed0329220e10e17

SHA1
c759a9224f0db8855bcadffd1bb5ea91cafec0f8

SHA256
605463d0b08330feefff6e00655cee199d8cf58708a4c1b26b993099daef656c

SHA512
b3c1b6a46fc04e8cebb7c77a427f85c6955472ac1368b393ab0f613043280ff86c666eee3a7871b3fcb5277b1c87444941db5b2ee562107dead2b6ac4b523850

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
76.4MB

MD5
05170f6fba0ec9d2ebc7a55ae2058d8b

SHA1
908b8d0335b06ee777d64c54bfaa5efe07d5e973

SHA256
c78fcad5a80cceb2eda549f9cb16f7d65071d53874460d1437f55ccbb21a9df1

SHA512
624edca4b27dac2af3e2efbd8b36a139ae54182283edafb856f3b9e89b4f5f9462f5ae6d79c0ae456588e2dc43da3dd3420153e60f8128e5ce62f41a9c61a0de

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
74.3MB

MD5
232c2d0f5633cb382db2f5ad33e03635

SHA1
9e5c2cb5592d0886c2e511478103a84d30d035d6

SHA256
4a81a8d18f69d8c779a203f389d4478a71a752a529e24cf332e213c9eb94d74a

SHA512
44a2cdcf1a7a322e15fa7cf14de5d6137f644457762b73c44a79a567f04d6a5c2200573f5cf972bab04cf5dec419fa198f7f222e6c91042bd7cbf05776a586c3

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
146.8MB

MD5
e8972aac33de894fca4665c7acd6acfd

SHA1
466990aa640c7a2b6dc1901c6e6ded29feb151d9

SHA256
4798444e4f8c32a757ecc8f1c5ad78aa795ac17dcd2b2f515967797975913ec4

SHA512
8b149aa98108bb04db5f18a97c10bf0c148d28bdd8f26098babb3c9efa3c0bd3364a48bc9f0cbcecacac383c614df486cf2f0b9ded7985188d9dfcd37bc15cc1

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
158.5MB

MD5
6a975b8a7e548d418aed2dcbb1f0c6e6

SHA1
bcba2390ece899d72bd4b6ea7d8e4a7eb19c3805

SHA256
416278603fab1f5acc9c379bd25b9dbed604ac43e3079a568de9f9f4c0c1b05d

SHA512
5aae8a3c6827acef931864c181a9760d6359725723fc7b5caf518559cddda2e315c06a1264e00132f6e294c4187351b6ba55fc8c93ca623cb4e33043fc44edb1

Download Submit
\Users\Admin\Music\rot.exe

Filesize
73.6MB

MD5
2c38fec63ff1e24f740341411c80911c

SHA1
711f7cc5910456688e3fa899343667a48243aa7b

SHA256
abe3780795dc93d062c96858e82baa32724cda697236a11746160dce97782d0f

SHA512
96f5146879078b18b22db2d041cb83244524a35ceebecca10260dd1035ffe3594ff6a6f6df2fb89ad56d4a6f6f418375f3c6272f860799a18957405feab33a83

Download Submit
memory/524-37-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/524-35-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/524-36-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1060-120-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-118-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/1060-116-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-114-0x0000000001FB0000-0x0000000001FF6000-memory.dmp

Filesize
280KB

Download
memory/1060-112-0x0000000002000000-0x0000000002040000-memory.dmp

Filesize
256KB

Download
memory/1060-110-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1060-108-0x0000000000180000-0x0000000000336000-memory.dmp

Filesize
1.7MB

Download
memory/1100-45-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/1100-47-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/1100-48-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-44-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-43-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/1100-46-0x00000000027C0000-0x0000000002800000-memory.dmp

Filesize
256KB

Download
memory/1172-57-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/1172-58-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-56-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/1172-55-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1172-54-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/1280-115-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1280-105-0x0000000001290000-0x0000000001446000-memory.dmp

Filesize
1.7MB

Download
memory/1280-119-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1280-117-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/1280-113-0x0000000000380000-0x00000000003C6000-memory.dmp

Filesize
280KB

Download
memory/1280-111-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/1280-109-0x000000006FD30000-0x000000007041E000-memory.dmp

Filesize
6.9MB

Download
memory/1524-136-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/1524-130-0x0000000000200000-0x00000000003B6000-memory.dmp

Filesize
1.7MB

Download
memory/1524-131-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Filesize
6.9MB

Download
memory/1524-145-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Filesize
6.9MB

Download
memory/1524-132-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/1524-135-0x0000000001F50000-0x0000000001F56000-memory.dmp

Filesize
24KB

Download
memory/1524-133-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Filesize
6.9MB

Download
memory/1524-134-0x0000000000620000-0x000000000063A000-memory.dmp

Filesize
104KB

Download
memory/1984-80-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1984-86-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1984-77-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2024-29-0x0000000073980000-0x0000000073F2B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-26-0x0000000073980000-0x0000000073F2B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-27-0x0000000073980000-0x0000000073F2B000-memory.dmp

Filesize
5.7MB

Download
memory/2024-28-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/2056-140-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-137-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-151-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2056-150-0x00000000735D0000-0x0000000073CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-148-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/2056-147-0x00000000735D0000-0x0000000073CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-144-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-146-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-143-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-141-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-138-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2056-139-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2228-97-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/2228-104-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/2228-98-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/2228-96-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/2228-99-0x0000000002810000-0x0000000002850000-memory.dmp

Filesize
256KB

Download
memory/2228-95-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-65-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-67-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2404-68-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2404-66-0x00000000736B0000-0x0000000073C5B000-memory.dmp

Filesize
5.7MB

Download
memory/2596-74-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/2596-71-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/2596-81-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download
memory/2596-79-0x00000000001D0000-0x0000000000202000-memory.dmp

Filesize
200KB

Download