Analysis
-
max time kernel
275s -
max time network
292s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
30-05-2024 23:50
General
-
Target
Uni.exe
-
Size
409KB
-
MD5
32efce8aac700ad0537f0834a2724133
-
SHA1
1a771fb73b59381d965f82a1527a5b6f29e7312a
-
SHA256
5279df302ea5593455036174afb4b5aa213645e1a39b679fb713e56d6ad6702f
-
SHA512
5aaa48270830d3180b61bd9b2b5d79221fdb50fe3615afa7cdd56159a811e7cb29cd2078cac365d54259d7dea94aaaa8d6d6bcca8c5aa10c161412528a7ca220
-
SSDEEP
12288:jpiREGJ1UQ4Csy+jxmkCLDwvZ0u+1TnscC2J:9wpJ78mkCLUvZr+hCQ
Score
10/10
Malware Config
Extracted
Family
quasar
Version
3.1.5
Botnet
Office04
C2
runderscore00-25501.portmap.host:25501
Mutex
$Sxr-enxCg9Guwcx91RRlfm
Attributes
-
encryption_key
ch8Yvy5yMUQU2xogQGGb
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uni.exe"C:\Users\Admin\AppData\Local\Temp\Uni.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
432KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
7.7MB