Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 04:35
General
- Target 2026-08-22_1fd2a7dd74f9148b30ef3e5bc0669ddb_cobalt-strike_coinminer_frostygoop_ghostlocker_glassworm.exe
- Size 5.0MB
- Sample260822-e7w8jaeq7y
- SHA256 a6bb3d4a2f21d63a5c7d1376fa9d3fdf8b4e1c7b5d774bf57704aae12c5b329f
Malware Config
Extracted
-
quasar
-
1.4.0
-
Office04
-
127.0.0.1:4782
-
c106d00e-1619-4d10-8e0d-9e15186e4f09
-
encryption_key
995AEFDA265DE1955C899268E6A6FE6FF9BC0BB0
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_1fd2a7dd74f9148b30ef3e5bc0669ddb_cobalt-strike_coinminer_frostygoop_ghostlocker_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_1fd2a7dd74f9148b30ef3e5bc0669ddb_cobalt-strike_coinminer_frostygoop_ghostlocker_glassworm.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4764-0-0x000001945DE50000-0x000001945DE60000-memory.dmp
memory/4764-1-0x000001945E130000-0x000001945E3FA000-memory.dmp
memory/4764-2-0x000001945DE50000-0x000001945DE60000-memory.dmp
memory/4764-3-0x000001945DE50000-0x000001945DE60000-memory.dmp
memory/4764-4-0x000001945E500000-0x000001945E550000-memory.dmp
memory/4764-5-0x000001945E970000-0x000001945EA22000-memory.dmp
memory/4764-6-0x000001945DE50000-0x000001945DE60000-memory.dmp
memory/4764-7-0x000001945DE50000-0x000001945DE60000-memory.dmp
memory/4764-8-0x000001945DE50000-0x000001945DE60000-memory.dmp