Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/03/2025, 06:18
General
-
Target
fb29a0de0487b94558425bddaebcd35bc23178df4dfd02764d210ac340aecbad.exe
-
Size
4.2MB
-
MD5
b142c22a4b730698066a9b01dd1cd332
-
SHA1
1db27bccc26eeef4ea2892f833c6363c239a3b0c
-
SHA256
fb29a0de0487b94558425bddaebcd35bc23178df4dfd02764d210ac340aecbad
-
SHA512
6294776bc8d7d16502be660819e2e3dfb11ce59724d4eb925244f1b06ca7a2129a57fa7cefceeb42e016c2b7b7880e0fa47f9c13691d00b414d501e1f859d7ca
-
SSDEEP
98304:5BBBYSBFyRfZBBBBBBBBBBBRZFIF2C0Ucwti78OqJ7TPB66K:AIGUcwti7TQl6
Score
10/10
Malware Config
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb29a0de0487b94558425bddaebcd35bc23178df4dfd02764d210ac340aecbad.exe"C:\Users\Admin\AppData\Local\Temp\fb29a0de0487b94558425bddaebcd35bc23178df4dfd02764d210ac340aecbad.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4.2MB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB