Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 11:30
General
-
Target
0fa0a6df35785b0dd29b7191158f0730984ee72cde5562ee48cb8cc9d637a1dd.exe
-
Size
5.9MB
-
MD5
b76667c1f978c6c98bbba2dfd7e315d2
-
SHA1
570de2264b32de819e7f02d6d5c8d4ce15277107
-
SHA256
0fa0a6df35785b0dd29b7191158f0730984ee72cde5562ee48cb8cc9d637a1dd
-
SHA512
6748b3cbd7ba55896d9ca767e83503cbfabbcfa0e47f83a4034a2a7ef255ec9adcdca38f5d5a0ee86cfcfd2cebd75990d740ec87a1554f4d4c96995748b8a77e
-
SSDEEP
98304:6+MUi7WbyjWfmd5hjVAlVZCBLJ/KwiNElydmw+q2Sg4:TMVzjWyj51TiNEmmwOSg4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Staking
C2
51.15.17.193:4782
Mutex
ff4f56ac-24e1-40ed-bb5c-e0b45b489ee4
Attributes
-
encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fa0a6df35785b0dd29b7191158f0730984ee72cde5562ee48cb8cc9d637a1dd.exe"C:\Users\Admin\AppData\Local\Temp\0fa0a6df35785b0dd29b7191158f0730984ee72cde5562ee48cb8cc9d637a1dd.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB