Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 11:39
General
-
Target
a06fb340d32ab66caf6d851719c4e51e77a3208b337a0bca99879cfaba35d2c7.exe
-
Size
8.6MB
-
MD5
18614ee994ac149ba306d530651d627c
-
SHA1
fbb67a2e7723e9c08b9faba8a4e5b1104ffefaed
-
SHA256
a06fb340d32ab66caf6d851719c4e51e77a3208b337a0bca99879cfaba35d2c7
-
SHA512
013aa8b9e32b17980906f44dd8e77deb1f81ed6520972a20bf8639cfb42d825ee6a4000cdcfc31071c1bd9c3dbee51613f53e859e771d3428747bbd646105af9
-
SSDEEP
98304:sX6BNhy0K9ZrLuJipnDfuvmrdLqEWsEtzo9aBN6K+tFXLx04:cuhy0+xLuJipDmc5Pnakxq4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Bat IS
C2
51.15.17.193:4782
Mutex
4cdc792e-d5cc-4480-93ab-ecbd2e6b9073
Attributes
-
encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06fb340d32ab66caf6d851719c4e51e77a3208b337a0bca99879cfaba35d2c7.exe"C:\Users\Admin\AppData\Local\Temp\a06fb340d32ab66caf6d851719c4e51e77a3208b337a0bca99879cfaba35d2c7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB