Overview

overview

10

Static

static

10

2026-10-24...at.exe

windows10-2004-x64

10

2026-10-24...at.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat
  • Size 4.5MB
  • Sample261025-ng7e9avy8j
  • SHA256 5b26d8de37d9ce27798a7eff03d4da8b4437a9bc3146f3f412186990a038e505
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
chromelevatorquasarcosturahacktoolmodulepackerratspywaretrojan

Malware Config

Targets

    • Target
      2026-10-24_ade0404beb7b15f2b43829c8b2d3b29e_elex_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc_xrat
    • Size 4.5MB
    • SHA256 5b26d8de37d9ce27798a7eff03d4da8b4437a9bc3146f3f412186990a038e505
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    chromelevatorquasarhacktoolmoduleratspywaretrojan

    • Detects ChromElevator

    • Family: ChromElevator

      ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

      hacktoolchromelevator

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • PulsaRAT library module

      Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

      ratmodule

    • Quasar payload

    • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Detects executables manipulated with Fody

    • Detects executables referencing virtualization MAC addresses

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks