Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
14/01/2026, 13:45
General
- Target ravexcoin-qt-win64.exe
- Size 3.1MB
- Sample260114-q2rxeaet9d
- SHA256 fb4724ee7a212ac268def735313a7c47771a02ecf632595ef9c704238972c9d3
Malware Config
Extracted
-
quasar
-
1.4.1
-
BTC
-
62.164.177.43:5850
-
baba152c-827a-468c-895b-247b083695cc
-
encryption_key
EA4E07B7C14A070A3F9E53FC586C35963A63E420
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Distr
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 45 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ravexcoin-qt-win64.exe"C:\Users\Admin\AppData\Local\Temp\ravexcoin-qt-win64.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ravexcoin-qt-win64.exe"C:\Users\Admin\AppData\Local\Temp\ravexcoin-qt-win64.exe" /VERYSILENT2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\RavexcoinQt.exe"C:\Windows\RavexcoinQt.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\ravexcoin.exe"C:\Windows\ravexcoin.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
DirectWriteForwarder.dll
Microsoft.Win32.Primitives.dll
Microsoft.Win32.Registry.dll
PresentationCore.dll
PresentationFramework-SystemXml.dll
PresentationFramework.Aero2.dll
PresentationFramework.dll
PresentationNative_cor3.dll
RavexcoinQt.dll
System.Collections.Concurrent.dll
System.Collections.NonGeneric.dll
System.Collections.Specialized.dll
System.Collections.dll
System.ComponentModel.EventBasedAsync.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Configuration.ConfigurationManager.dll
System.Diagnostics.Process.dll
System.Diagnostics.TraceSource.dll
System.IO.Packaging.dll
System.Linq.dll
System.Memory.dll
System.Net.Primitives.dll
System.Net.Requests.dll
System.Net.WebClient.dll
System.Net.WebHeaderCollection.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Private.Xml.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Runtime.CompilerServices.VisualC.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.Runtime.InteropServices.dll
System.Threading.dll
System.Windows.Extensions.dll
System.Xaml.dll
UIAutomationProvider.dll
UIAutomationTypes.dll
WindowsBase.dll
wpfgfx_cor3.dll
srAJlvyLV5V9iaEk.dll
ravexcoin.exe
memory/2340-2-0x0000000000400000-0x0000000000733000-memory.dmp
memory/2340-0-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/3268-38-0x0000000000400000-0x0000000000733000-memory.dmp
memory/3268-4-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/4084-39-0x0000000001C10000-0x0000000001F34000-memory.dmp
memory/4084-112-0x0000000006530000-0x0000000006AD6000-memory.dmp
memory/4084-115-0x0000000006080000-0x0000000006112000-memory.dmp
memory/4084-134-0x0000000006120000-0x000000000612A000-memory.dmp
memory/4084-476-0x0000000007100000-0x0000000007718000-memory.dmp
memory/4084-485-0x0000000006B30000-0x0000000006B80000-memory.dmp
memory/4084-551-0x0000000006D80000-0x0000000006E32000-memory.dmp
memory/4084-581-0x0000000008530000-0x000000000856C000-memory.dmp
memory/4084-580-0x00000000084D0000-0x00000000084E2000-memory.dmp
memory/4084-582-0x00000000085E0000-0x0000000008646000-memory.dmp