Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
02-01-2025 00:32
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
2c55c3ba3aa93887c266436bcaaae5c4
-
SHA1
0e20e8a15bbf5efd0bf927e49ffc8237e691951c
-
SHA256
e815640357032206eb40f35f30804f4bb0cb14addf9858cdc36297b583b3cbfa
-
SHA512
ffe786d730e8de697a41ac89e449de7717d2aee09e4ef5653268d8d584d798a89c132ca5f32051c07a99378cf0ff6b45a8fc2ab99c53bab0fc3b4a74cd4b5968
-
SSDEEP
49152:6vbI22SsaNYfdPBldt698dBcjHgk/LWmzAwoGdu8THHB72eh2NT:6vk22SsaNYfdPBldt6+dBcjHp/Lx+
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.100.244:443
Mutex
e4b3274f-fb75-4407-9316-141c32c7c7ca
Attributes
-
encryption_key
53FC47CB30FD7835477E4751610AF9D6FC6D5AFB
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB