Analysis
-
max time kernel
119s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-12-2024 13:34
General
-
Target
Quasar v1.4.1/client.exe
-
Size
3.1MB
-
MD5
f4d16cfe4cad388255e43f258329f805
-
SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
-
SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
-
SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
-
SSDEEP
49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx
Score
10/10
Malware Config
Extracted
Family
quasar
Attributes
-
reconnect_delay
5000
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe"C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
9.9MB
-
Filesize
9.9MB