Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-11-2024 23:41
General
-
Target
687c5903af67e7ae2df617f249ef22502998e4524ccb34a27eaac389b8e61728.exe
-
Size
4.8MB
-
MD5
9a7cea63db91937ec2fa0c4a40dcde82
-
SHA1
dbc121740eb6aa3221beadd3ae69df1ce095c441
-
SHA256
687c5903af67e7ae2df617f249ef22502998e4524ccb34a27eaac389b8e61728
-
SHA512
36e6a806125b1d80e97482f0b03a7481a136f01d2808169f171d89c54d2faf6f5b6913f4751dc737d5dc672f63622e379fd87f306cec2e076d8a5e73d33059dd
-
SSDEEP
98304:nMuUyniWYpCYL5ztUvPPpmDw7FhcNXIvNS12RA4:njifpTptUvpWw7FmNXENSV4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Staking
C2
51.15.17.193:4782
Mutex
ff4f56ac-24e1-40ed-bb5c-e0b45b489ee4
Attributes
-
encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\687c5903af67e7ae2df617f249ef22502998e4524ccb34a27eaac389b8e61728.exe"C:\Users\Admin\AppData\Local\Temp\687c5903af67e7ae2df617f249ef22502998e4524ccb34a27eaac389b8e61728.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB