Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
31/03/2025, 12:12
General
-
Target
Client-built.exe
-
Size
871KB
-
MD5
164b26c14f3e5e20cc50a3c30f2e960f
-
SHA1
b21f203a867fa641e3629c8a00a38288dc1f4d66
-
SHA256
7ffb2d5b4a2efed158ebcc6185a0bcf56ebd72b50a426592df7267d57dc87b51
-
SHA512
118e8335afaefd5b7ea3a96afd493e9681943828246c58c8981d2fe661ed7e518f3551ffbca06af39a5af78f6d39bf8b3808aeb8fe954b10aa8568fcc566a227
-
SSDEEP
24576:OG/bFSSWHIPbcNK0KKfaOwI55l2SyKgAPMC:t/bF4EgKKHwCBF
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.5.0
Botnet
test
C2
10.9.149.190:1194
Mutex
78a5da3d-f65b-4b37-a195-c840d91063b3
Attributes
-
encryption_key
E354BE8686EBA2DA416ABC82619DB721FFFDB307
-
install_name
Test.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsar Client Startup
-
subdirectory
$Test
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
896KB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
312KB
-
Filesize
712KB
-
Filesize
8KB
-
Filesize
10.8MB