Analysis
-
max time kernel
126s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
07-06-2024 02:32
General
-
Target
abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62.exe
-
Size
348KB
-
MD5
16f3ac9a4ca5183fec9a3a21fd3488e1
-
SHA1
ea6baf86951a97d224f25a893ecd00a156e1a993
-
SHA256
abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62
-
SHA512
8ec7a8f684c0318980c6c5b42932c4ef42734199ad6abef22d53b0ba12f14a34012f9b269d064fe60c943693a375fd49f66b8e568d061b277a0ee3de0672d586
-
SSDEEP
6144:ezNHXf500Mb5t5eewCbYTio7QiWPpQR63ejZEe:wd50HtkRzFQ7PO6OjZEe
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.3.0.0
Botnet
Office04
C2
39.105.31.193:50050
Mutex
QSR_MUTEX_H0vcBfjQRUzioI2ltj
Attributes
-
encryption_key
SAA4yJPZ67wykJkTFy3u
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload 1 IoCs
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables containing common artifacts observed in infostealers 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62.exe"C:\Users\Admin\AppData\Local\Temp\abe23d8d73061f09f6c66acb1fba3fc7f952a8f57f583acfd2c6a5480aed8d62.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB