quasar | 759d5281882dfba5e7504f46a71c534a7b844701fda511149bc38c3ff53be0f1

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 13:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plswork.exe
Size

3.1MB
MD5

6177caea7e42e38c38bc0bd47bb9331c
SHA1

76e6b53c666212a9dd06c943f22cc360c5756b36
SHA256

759d5281882dfba5e7504f46a71c534a7b844701fda511149bc38c3ff53be0f1
SHA512

dc2ce7aedf1c93b06e22e8995e38e89057165aa07d5dc381e48588a1174b099d6d0c88aebc5cdabed9edf6d730e5bb3a884caa2064815a68cc16860f707997f3
SSDEEP

49152:XvTlL26AaNeWgPhlmVqvMQ7XSKW/RJ6FbR3LoGd45THHB72eh2NT:XvJL26AaNeWgPhlmVqkQ7XSKW/RJ6X

Score

10^/10

quasar first spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

first

nature-documented.gl.at.ply.gg:57757

Mutex

1fae1825-d0ee-4a31-a2bb-ad761ecb2c11

Attributes

encryption_key
59DD70006F5E5424ACBA442199524AA9815F439E
install_name
Calculator.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RtkAudUService86
subdirectory
Calculator_UWP

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2396-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	plswork.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	plswork.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2396	plswork.exe

C:\Users\Admin\AppData\Local\Temp\plswork.exe
"C:\Users\Admin\AppData\Local\Temp\plswork.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2396-0-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000000AB0000-0x0000000000DD4000-memory.dmp

Filesize
3.1MB

Download
memory/2396-2-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2396-3-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2396-4-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download