quasar | 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62

Analysis

max time kernel
450s
max time network
457s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 07:04

Target

Quasar v1.4.1/client.exe
Size

3.1MB
MD5

f4d16cfe4cad388255e43f258329f805
SHA1

fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
SHA256

8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
SHA512

867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
SSDEEP

49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx

Score

10^/10

Family

quasar

Attributes

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral12/memory/392-1-0x0000000000EB0000-0x00000000011DA000-memory.dmp family_quasar
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

client.exe

description pid process

Token: SeDebugPrivilege 392 client.exe

resource	yara_rule
behavioral12/memory/392-1-0x0000000000EB0000-0x00000000011DA000-memory.dmp	family_quasar

description	pid	process
Token: SeDebugPrivilege	392	client.exe

C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe
"C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

memory/392-0-0x00007FF92ECD3000-0x00007FF92ECD5000-memory.dmp

Filesize
8KB

Download
memory/392-1-0x0000000000EB0000-0x00000000011DA000-memory.dmp

Filesize
3.2MB

Download
memory/392-3-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Filesize
10.8MB

Download
memory/392-4-0x00007FF92ECD0000-0x00007FF92F792000-memory.dmp

Filesize
10.8MB

Download