Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-12-2024 08:23
General
-
Target
edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17.exe
-
Size
8.2MB
-
MD5
ab0d88d920d75c9de43ccbdd901c8a53
-
SHA1
638197f5a23428f1c15a0a5473b6558d263b0a0c
-
SHA256
edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17
-
SHA512
25e1f1f5afe0cb1920be2d6a1db59f11b9f34b0bd154d3d553eb0dc44ecbc810463a7e1dcca5a176d7a08f0a34ed3e669a56cd35f9cc5ed796bfa5385f0e15f7
-
SSDEEP
98304:L6KJqPxBPsa29RMwzAAFySYrz0Cvt30F0BS9YR4:LHWPsa+RMwzVu0kJ0mBH4
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Slimo
C2
51.15.17.193:4782
Mutex
e318fab0-811e-40a6-b0aa-1e21015956c8
Attributes
-
encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17.exe"C:\Users\Admin\AppData\Local\Temp\edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB