Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-02-2025 05:51
General
-
Target
exacag.exe
-
Size
3.1MB
-
MD5
42994901f5bc8b43588bb54889f1db81
-
SHA1
bc4e4fd8cb12e302301fa39fdbbb0f48d914fb85
-
SHA256
129dbf173e38d9d37f8c66513290a30bc0790e9fdcdb5c9043a399ee6c889493
-
SHA512
783970fc5d868ccb7f1d346acbcc82206df9c0c893162588f47dc93aa1ee457330d7c7e469a7e3d13c9bd8bca4bcbc6201c9ff2828aa50e4da7bd50134c7b3d1
-
SSDEEP
49152:7vNG42pda6D+/PjlLOlg6yQipVtoS71JZ3oGdpTHHB72eh2NT:7vk42pda6D+/PjlLOlZyQipVtoSp
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Sigorta
C2
0.0.0.0:7777
13.48.129.198:7777
172.31.0.240:7777
Mutex
3b0592fc-14a1-4b8e-9803-69284ea2b6d2
Attributes
-
encryption_key
E0BB4B221F7AADA73B9059B33A3CFF096A518413
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\exacag.exe"C:\Users\Admin\AppData\Local\Temp\exacag.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB