Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
31-12-2024 21:51
General
-
Target
44037f6c2fed815da4c59b50479561f5.exe
-
Size
3.1MB
-
MD5
44037f6c2fed815da4c59b50479561f5
-
SHA1
f724de9954505061cd9f4fbe90bd57d8375ef6d1
-
SHA256
59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553
-
SHA512
e33bb327a8b8afc38bba20adfe4d00d99bd3772d65df1125796e5de00d02e37e8ea3a9ce48d16d5374343079d7addf8456c09b053ef9dfec35d183aaddfdf30d
-
SSDEEP
49152:twAlUPhZwv68DkG17WlqTz5oqMn0f8bUlUUU+UUUZAMoAGdQTHHB72eh2NT:twsUPhZwv68DkG17WlqTzeqMn0fcK
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.2
Botnet
Java
C2
45.83.244.141:4782
Mutex
18dba2e6-0f3a-4d9f-b95d-78cbc696f514
Attributes
-
encryption_key
88D5D2E6C33089786488A381589CC2587B1B6759
-
install_name
$77-cmd.exe
-
log_directory
$77-Logs
-
reconnect_delay
1000
-
startup_key
$77-cmd
-
subdirectory
$77-SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44037f6c2fed815da4c59b50479561f5.exe"C:\Users\Admin\AppData\Local\Temp\44037f6c2fed815da4c59b50479561f5.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB