quasar | 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-01-2025 10:52

Target

Quasar.v1.4.1.zip
Size

3.3MB
MD5

13aa4bf4f5ed1ac503c69470b1ede5c1
SHA1

c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
SHA256

4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
SHA512

767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
SSDEEP

49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015f38-4.dat	family_quasar
behavioral1/memory/2476-11-0x0000000000FC0000-0x00000000010F8000-memory.dmp	family_quasar
behavioral1/memory/2908-24-0x00000000013C0000-0x00000000014F8000-memory.dmp	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2476	Quasar.exe
2908	Quasar.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
316	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
316	7zFM.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Suspicious use of FindShellTrayWindow 3 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 2476	316	7zFM.exe	30
PID 316 wrote to memory of 2476	316	7zFM.exe	30
PID 316 wrote to memory of 2476	316	7zFM.exe	30
PID 2476 wrote to memory of 2800	2476	Quasar.exe	31
PID 2476 wrote to memory of 2800	2476	Quasar.exe	31
PID 2476 wrote to memory of 2800	2476	Quasar.exe	31
PID 316 wrote to memory of 2908	316	7zFM.exe	33
PID 316 wrote to memory of 2908	316	7zFM.exe	33
PID 316 wrote to memory of 2908	316	7zFM.exe	33
PID 2908 wrote to memory of 2596	2908	Quasar.exe	34
PID 2908 wrote to memory of 2596	2908	Quasar.exe	34
PID 2908 wrote to memory of 2596	2908	Quasar.exe	34

C:\Users\Admin\AppData\Local\Temp\7zOC31245E6\Quasar.exe

Filesize
1.2MB

MD5
12ebf922aa80d13f8887e4c8c5e7be83

SHA1
7f87a80513e13efd45175e8f2511c2cd17ff51e8

SHA256
43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e

SHA512
fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275

Download Submit
memory/2476-11-0x0000000000FC0000-0x00000000010F8000-memory.dmp

Filesize
1.2MB

Download
memory/2908-24-0x00000000013C0000-0x00000000014F8000-memory.dmp

Filesize
1.2MB

Download