Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
22-01-2025 09:49
General
-
Target
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe
-
Size
79KB
-
MD5
8931b2ac2268f43be3b1802fdf106bc0
-
SHA1
d137c943c0b7299660f9cc0a2acdf31c5170fdf9
-
SHA256
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2
-
SHA512
79ab861ee50995466bc1c944e7567230815575ab4b2392712958d8dffd51cebbac553d578ddb1552edd99a4a34c83f8ae386c4761c02ffaffb0e0eba0d6d0ee5
-
SSDEEP
1536:h9JC+t06xgFp7fNbW07sQ4AmejEuEEQtlbrqVF7Hsecx:rAwwp7fNC04Q4TKTAlbr8F7Hsx
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.3.0.0
Botnet
newVic
C2
recoxxx.work.gd:3000
Mutex
QSR_MUTEX_qAzzUei5mlwzbguQm2
Attributes
-
encryption_key
xoLtUvoRon1EOl12Z4l0
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe"C:\Users\Admin\AppData\Local\Temp\c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB