Overview

overview

10

Static

static

10

Quasar v1....e.html

windows10-1703-x64

4

Quasar v1....to.dll

windows10-1703-x64

1

Quasar v1....ok.dll

windows10-1703-x64

1

Quasar v1....db.dll

windows10-1703-x64

1

Quasar v1....db.dll

windows10-1703-x64

1

Quasar v1....ks.dll

windows10-1703-x64

1

Quasar v1....il.dll

windows10-1703-x64

1

Quasar v1....at.dll

windows10-1703-x64

1

Quasar v1....on.dll

windows10-1703-x64

1

Quasar v1....ar.exe

windows10-1703-x64

10

Quasar v1....ib.dll

windows10-1703-x64

1

Quasar v1....nt.exe

windows10-1703-x64

10

Quasar v1....et.dll

windows10-1703-x64

1

Analysis

  • max time kernel
    129s
  • max time network
    136s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18-05-2024 21:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quasar v1.4.1/client.exe

  • Size

    3.1MB

  • MD5

    f4d16cfe4cad388255e43f258329f805

  • SHA1

    fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d

  • SHA256

    8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e

  • SHA512

    867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f

  • SSDEEP

    49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx

Score
10/10
quasarspywaretrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    5000

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe
    "C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2836-0-0x00007FFB570B3000-0x00007FFB570B4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2836-1-0x0000000000590000-0x00000000008BA000-memory.dmp

    Filesize

    3.2MB

    Download

  • memory/2836-3-0x00007FFB570B0000-0x00007FFB57A9C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2836-4-0x00007FFB570B0000-0x00007FFB57A9C000-memory.dmp

    Filesize

    9.9MB

    Download