Overview

overview

10

Static

static

10

2026-11-05...oe.exe

windows10-2004-x64

10

2026-11-05...oe.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-11-05_378fd5cc7ba2f94a096be155d6c0eacb_elex_ghostweaver_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_xrat
  • Size 9.6MB
  • Sample261107-e2qtkavzht
  • SHA256 9fc13588a7d032b1aeb6af598a573ac2e9f8fa521350a1d2c1e7979ed3cd7638
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
chromelevatorquasarcosturahacktoolmodulepackerratspywaretrojan

Malware Config

Targets

    • Target
      2026-11-05_378fd5cc7ba2f94a096be155d6c0eacb_elex_ghostweaver_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat_stealc_xrat
    • Size 9.6MB
    • SHA256 9fc13588a7d032b1aeb6af598a573ac2e9f8fa521350a1d2c1e7979ed3cd7638
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    chromelevatorquasarhacktoolmoduleratspywaretrojan

    • Detects ChromElevator

    • Family: ChromElevator

      ChromElevator is an open-source post-exploitation tool for stealing user data from Chromium browsers.

      hacktoolchromelevator

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • PulsaRAT library module

      Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

      ratmodule

    • Quasar payload

    • Custom signature

      Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

    • Custom signature

      Detects Windows executables referencing non-Windows User-Agents

    • Custom signature

      Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

    • Custom signature

      Detects encrypted or obfuscated .NET executables

    • Custom signature

      Detects executables containing artifacts associated with disabling Widnows Defender

    • Custom signature

      Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Custom signature

      Detects executables manipulated with Fody

    • Custom signature

      Detects executables referencing many IR and analysis tools

    • Custom signature

      Detects executables referencing virtualization MAC addresses

    • Custom signature

      detects Windows exceutables potentially bypassing UAC using eventvwr.exe

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks