Edit tour
Windows
Analysis Report
UXxZ4m65ro.exe
Overview
General Information
Sample name: | UXxZ4m65ro.exerenamed because original name is a hash value |
Original sample name: | 6A0393CCE6FF34424DDAD27B162B67F0.exe |
Analysis ID: | 1585477 |
MD5: | 6a0393cce6ff34424ddad27b162b67f0 |
SHA1: | c67c3d31dd2891d9f0cd070cdf957554ecfd3550 |
SHA256: | 4c7a86733a4ac849eec1b49179f64b81ed852c47be714d91c3b00d64b79e1399 |
Tags: | exeQuasarRATRATuser-abuse_ch |
Infos: | |
Detection
Quasar
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected Quasar RAT
C2 URLs / IPs found in malware configuration
Found API chain with Download & Execute functionality
Hides that the sample has been downloaded from the Internet (zone.identifier)
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Uses dynamic DNS services
Uses known network protocols on non-standard ports
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Yara signature match
Classification
- System is w10x64
- UXxZ4m65ro.exe (PID: 6860 cmdline:
"C:\Users\ user\Deskt op\UXxZ4m6 5ro.exe" MD5: 6A0393CCE6FF34424DDAD27B162B67F0) - c.exe (PID: 6208 cmdline:
"C:\Users\ user\Deskt op\c.exe" MD5: 85F734C7FF103995E9FFA75BF661EF4F) - RegAsm.exe (PID: 5064 cmdline:
"C:\Window s\Microsof t.NET\Fram ework\v4.0 .30319\Reg Asm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)
- cleanup
Name | Description | Attribution | Blogpost URLs | Link |
---|---|---|---|---|
Quasar RAT, QuasarRAT | Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult. |
{"Version": "1.4.1", "Host:Port": "win32updatess.DUCKDNS.ORG:2;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "b70adc1c-122d-4b90-9f59-304d0ab81cd5", "StartupKey": "Quasar Client Startup", "Tag": "2026", "LogDirectoryName": "Logs", "ServerSignature": "Sv/Z3hPopdPdwb9BHW3Am3u9vmqiaP2JczDj7YdItaG8nYeXtl6fr67/J/xguaZRaG11yeHmsVQa+UahkHD2SiJZIKuY+TOHGXCkiYYpNPj8xM5+Pj76yXgXyYSCKSEv9Jm2iUB6STtZtM2lg96/Vt8Xq+rrcfY2TM0me86vYlUwWD/OH2wDaJ+rSHk7VAlt9PqBdNET7Shq2zQqiocTou37e1Sk0SLiz9eunMuIlIl5mqnrpDI3MnECL5+xMLU2V554IOT8Hqy75LB+3umBC9KBbPocm1Nmq5l7JxSS8BZScguv3eszxrGOLGHLUyOUCKPno/KFySRSqnljMrLzJLaOb8TabSP2u5l978o/pmzxzEJr+VYcFXCms795gcHR3v4Ob7+e/WdjGHbf106Waz8KCRHhMRhvRXWc01iGD7d8yN5tLPm3bROmXN7ijIs0JIW47wGJrgo96xMQPZgiCcOq//vp3GOilRa97Lc9LDbWrzvZmsB1f65tHUdys5QB5A65SU8zxU/SZEqd1iisX0uNMrpQKgZ4VynxwFGKk4bg6YNa7ALGmHNOlylQwir1HCFydiq4wreEmpvq3XSlHiQaxlttmuC+Vcds4Z14xjgm+pu7HxRWG8IN04wl+93oEOuVIHJ/L06eULWUsJ7y6JjJ4UBoq19vNITnsx0JyB4=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAMWM11pg49u5eNPpOzNHvTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIzMTE0MTI0NFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEArc+ETJnDaahXbqone1YdeOIuBr42LT5ISMyi4P2hTYqXK3fy00iuzOVnFXeROJbiJRAzSrk7WyXEFWVkAXJD2K6dO5d2UsN5H7DLjR9gfigFgwazEk0LkS08seAcJXe5hvMEljzTGlLo8AXEucoP5sm1OsuhIclWU6V76awPYT6JXLqgIBXx2zOE1pCC3b0Y7k1b2ZfA1DTX0dX5soRN9QjsFIW19dMpJui/gP/9NfK9v6qFMmxqgk+Z5lfwXH1W6wHPtWdOUMiGxUB4CM5qkQ9Cxi6lNNd3Fw5OSgedyP9QAP0OoR+cSY9bH7h6kHoJsLI4ubsmXfzRAsJOXGtvoezx649bQ4vb2m1+nVO46JBDHXJDZn77e2VuTFZu+blc9ISizNzO/uvA1pLXrHvqBbbofOvVYT1ytFE7oR02Pq6o2Brcy5ZNovT7qRKQ5jGQKj0vxwuU0nbrbXE9uDE4d0JC+1R6pTQ7G61bxM/L15LSPoRJbQyh4AxY6/HDnV5f1Dlo+c3hyWjlguh9ZnOaTkMuuBX93exIAScFSzyTVrYG4wZcCJRzX6bWH6Gdz/C0B/to0DjUIkbsMzVURscFmlyo18veT/yectnvQi3WonZDdyPleq8d9t7GGhhZH8Zf06OrDM1ZNriBWWcZSp6a3CCV9/GREiUBjFBes6QcPvkCAwEAAaMyMDAwHQYDVR0OBBYEFDDiPmyiKv3cFPZqo2/WtQ82UNX1MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBAFhcdCEBHZJf+XrdfdwptEkvH8tNHhnbQxF4+EuHT8oGUMavYCDFBiik9oWoF8Yf3dzVFbwgj2Id0lKmuwlQ9+zrKigvnaaDYTLGKF7tGrvRLGjPWOMEP82Np0gXyqut+XM0RKOzWrswrxoqCxloP+C7DMK1B28AK9eiDOT+GdHpYKsrA7dj2USqlf88o+h95l8a2GDLWwpVhn0MX0iHTuFft38XDLmnR0oQXm9rscHrDA71W3em9lyePtGTL9t5YIh2eRkvxWJqPOUJQO5BzaYXZERqkcNnaPrZX4KZMy2hfOKrvHAt5mVOdHicKUTR1TwDUkHW/a1pv/G0A/q3E+HKhlb9qYa7GLE1/RGrKjiP9Bb/fBxD59AmAGb57LH8lCNuMJImT5n1UGMGBy/wH2vMFRSkygMj5nRdxB+uMmnbQHXNJa3jHgVS88mz+//fWDY130dImBkpWUbXf9Naqjr/POGfjzZ0jqcDBd3XppyP6pKqA/xv1ln69bpAdqSJQr0KIMM9D+pqZoyXhx+51GmMKFoU593I9HhW9AjPRuv3mlsEzcxHQ8zUL+i+J4K74/Zxbe4b4faHQ3pXUERjfemTteWUzujG8g2nSnPrs0v4Prp1VDbtlK3KW3p3ewzQgAm818ndJ+EFy3TZ+qqjnFhUF+338xhaDg618UfD0pm5"}
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
Click to see the 5 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Quasar | Yara detected Quasar RAT | Joe Security | ||
JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
MAL_QuasarRAT_May19_1 | Detects QuasarRAT malware | Florian Roth |
| |
INDICATOR_SUSPICIOUS_GENInfoStealer | Detects executables containing common artifcats observed in infostealers | ditekSHen |
| |
MALWARE_Win_QuasarStealer | Detects Quasar infostealer | ditekshen |
| |
Click to see the 9 entries |
⊘No Sigma rule has matched
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-07T17:42:20.606788+0100 | 2035595 | 1 | Domain Observed Used for C2 Detected | 185.249.198.173 | 2 | 192.168.2.4 | 49732 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-07T17:42:20.606788+0100 | 2027619 | 1 | Domain Observed Used for C2 Detected | 185.249.198.173 | 2 | 192.168.2.4 | 49732 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-07T17:42:05.916050+0100 | 2018581 | 1 | A Network Trojan was detected | 192.168.2.4 | 49730 | 31.220.92.125 | 8088 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-07T17:42:05.916050+0100 | 2019714 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49730 | 31.220.92.125 | 8088 | TCP |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2025-01-07T17:42:05.916050+0100 | 2803270 | 2 | Potentially Bad Traffic | 192.168.2.4 | 49730 | 31.220.92.125 | 8088 | TCP |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: |
Source: | Malware Configuration Extractor: |