Analysis
-
max time kernel
101s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
19/04/2025, 09:01
General
-
Target
obfus2.exe
-
Size
1.5MB
-
MD5
fd490afa1de4699862b5950ea751af37
-
SHA1
72c8f24b54e8fb12ade27dc0dc483f5c96b16f7c
-
SHA256
c10b9a9c1202b0f18670a8599b5aa6852dddf40b12b7cf5a3787acd813d8a23c
-
SHA512
0839bd2cb8653c0fe67154dc1a1b2976f99cbe5d9a1e71236d66f4290ec323f32b03120191aa18d5db5d623cb0320978929887a18523c82e210aba0fbb144a08
-
SSDEEP
24576:G42/US2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9zC5u6a1DFI:GZ/u7wR2EgKKm77LrwCB6Pw
Score
10/10
Malware Config
Extracted
Family
quasar
C2
��:a>�后��s��6�F�l濺�,@ 3&�
Attributes
-
encryption_key
0A2600918F5E13281DD3F3E3CF35CA2FEACB6884
-
reconnect_delay
3000
-
startup_key
�� D���s�+���\� r8t$�
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\obfus2.exe"C:\Users\Admin\AppData\Local\Temp\obfus2.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.6MB
-
Filesize
104KB
-
Filesize
10.8MB
-
Filesize
232KB
-
Filesize
72KB
-
Filesize
320KB
-
Filesize
712KB
-
Filesize
312KB
-
Filesize
304KB
-
Filesize
168KB
-
Filesize
296KB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
8KB
-
Filesize
10.8MB