Overview

overview

10

Static

static

10

59405ec9b9...53.exe

windows7-x64

10

59405ec9b9...53.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2025 02:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553.exe

  • Size

    3.1MB

  • MD5

    44037f6c2fed815da4c59b50479561f5

  • SHA1

    f724de9954505061cd9f4fbe90bd57d8375ef6d1

  • SHA256

    59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553

  • SHA512

    e33bb327a8b8afc38bba20adfe4d00d99bd3772d65df1125796e5de00d02e37e8ea3a9ce48d16d5374343079d7addf8456c09b053ef9dfec35d183aaddfdf30d

  • SSDEEP

    49152:twAlUPhZwv68DkG17WlqTz5oqMn0f8bUlUUU+UUUZAMoAGdQTHHB72eh2NT:twsUPhZwv68DkG17WlqTzeqMn0fcK

Score
10/10
quasarjavaspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.2

Botnet

Java

C2

45.83.244.141:4782

Mutex

18dba2e6-0f3a-4d9f-b95d-78cbc696f514

Attributes
  • encryption_key

    88D5D2E6C33089786488A381589CC2587B1B6759

  • install_name

    $77-cmd.exe

  • log_directory

    $77-Logs

  • reconnect_delay

    1000

  • startup_key

    $77-cmd

  • subdirectory

    $77-SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553.exe
    "C:\Users\Admin\AppData\Local\Temp\59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2988-0-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2988-1-0x0000000000870000-0x0000000000B94000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2988-2-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2988-3-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2988-4-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

    Filesize

    9.9MB

    Download