Analysis
-
max time kernel
25s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
-
submitted
28/03/2025, 16:32
General
-
Target
Client-built.exe
-
Size
1.3MB
-
MD5
89dedd5a5be40e10d15d8ddead0840e2
-
SHA1
e6ec62026b2b86534eedce986b8f14bad02991b1
-
SHA256
2e4dd13fca230aa1d5aa024bf148b64155226883d26bc04d41a2bf4254e70495
-
SHA512
168ba353a7e982d5a592c08753d21cef95671c0c3f585a3727833ae540f9949324d9ce1cabcb604b1047235da1cc8c327dcbcd5a347652f82463f390516ee291
-
SSDEEP
24576:9WA+qYdaeoXgOSWHIPbcNK0KKfaOwI55l2SXO8vyjFTFpi3sed:9W0eo/EgKKHwCB+9FTTi
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.5.0
Botnet
nia
C2
172.22.94.59:4782
Mutex
59872fd7-8c22-416a-8e2e-11dbf8cf0d11
Attributes
-
encryption_key
8F2068A83872A8272FFF6545A763F8997C3BDCD2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
312KB
-
Filesize
8KB
-
Filesize
10.8MB