Analysis
-
max time kernel
1800s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12-05-2024 02:53
General
-
Target
SynV2.exe
-
Size
3.1MB
-
MD5
007e5cb679d162307ae1e97aae6b60bb
-
SHA1
a03429b7d5bf4fbe507863f110782b17b3de98ef
-
SHA256
82c4ebbea3a1cf61cb81196e865149b679df63dacaceef1e1242ce9b855aedf7
-
SHA512
eb2298577149e34238475eee4329ac031efe4433ca8d3b9951bc1914c52e633a8c4b1034c4ff9b6f79364250cede584b25d9c13556f4fe35ec6be5ac0661a2c0
-
SSDEEP
49152:pvjt62XlaSFNWPjljiFa2RoUYI204lhhgvJ6EoGdxsTHHB72eh2NT:pvx62XlaSFNWPjljiFXRoUYIchm
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Shiba
C2
sites-mood.gl.at.ply.gg:50107
Mutex
987c652c-2a4e-4c5d-bc39-00c8c0f35c5c
Attributes
-
encryption_key
A88D7FED7F655EBDC4F99C21BAE5EC62300AADC7
-
install_name
$sxr-insta.exe
-
log_directory
$sxr-logs
-
reconnect_delay
1000
-
startup_key
$sxr-mstha
-
subdirectory
$sxr-start
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SynV2.exe"C:\Users\Admin\AppData\Local\Temp\SynV2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
8KB
-
Filesize
10.8MB