Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22/03/2025, 06:13
General
-
Target
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe
-
Size
555KB
-
MD5
04c25605f640412aa0be2abecda263df
-
SHA1
b90b4a69730917fb57bfa4238ff506d1db536703
-
SHA256
867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f
-
SHA512
65ebd7fca6fe0f4c7a069226a2dda2bb3c68489c8e363cc73be6b4dff208da96cf1c8a3ea6c532e4c2d1a75e9d6c3582ce132c9c2c2672370cd86a1262f9d177
-
SSDEEP
12288:OusTy3x2mU/iLYStKT7yFPb2bNR/SN4UY1lc6VA:Oq3nUfStKHIPbcNRf3fc6W
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.5.0
Botnet
Office04
C2
pa-force.gl.at.ply.gg:12214
Mutex
ffecbda9-25fa-4e3c-a5ea-37cd0d0376aa
Attributes
-
encryption_key
197572FC97D91919662FC0B14F52E41F83A2F651
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe"C:\Users\Admin\AppData\Local\Temp\867e002192bde08a346a10ca74cc4a611293f0e312a048bc63b7dfa0f87cfc1f.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
576KB
-
Filesize
9.9MB
-
Filesize
96KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
9.9MB