Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-01-2025 06:46
General
-
Target
82AB58A9D1AF41EB4EA63F2417366CC9.exe
-
Size
3.1MB
-
MD5
82ab58a9d1af41eb4ea63f2417366cc9
-
SHA1
dab04289bc735e8dcd4ca248681f095803a3d87e
-
SHA256
92a61acb5fd10680e88164bc308dc8c64195245c443a7ecc862e77bb2f21586b
-
SHA512
e2ee7c47fc17c1f06dae659baf4ef2188d6abe7cb37c43002c2c68d2d624d7ba125859fa243eff854a20eecade3b914a7f6f3cc93d5e460b3ff9248659de07ee
-
SSDEEP
49152:WvfI22SsaNYfdPBldt698dBcjH/NRJ6IbR3LoGdWzTHHB72eh2NT:Wvw22SsaNYfdPBldt6+dBcjH/NRJ6i
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Firewall v01
C2
73.63.222.152:4782
Mutex
43c70f00-365b-49e7-8892-e9b0651b1384
Attributes
-
encryption_key
1F4C9888D5F5A2516EAA3692591870162B9295E5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82AB58A9D1AF41EB4EA63F2417366CC9.exe"C:\Users\Admin\AppData\Local\Temp\82AB58A9D1AF41EB4EA63F2417366CC9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.1MB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
8KB
-
Filesize
10.8MB