File name: | 1.zip |
Full analysis: | https://app.any.run/tasks/3ddd1964-f27a-420a-8cd9-139b400c754e |
Verdict: | Malicious activity |
Threats: | Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely. |
Analysis date: | September 19, 2019, 07:54:21 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 82AA39B81F3183C6752DDB58BF6EEFAA |
SHA1: | 6660DDF5CEB5B8C38008AE3114F3C2E9A230896E |
SHA256: | 2384E070DE4282268491DF5F79E4E5E8D8CA6723C8D38F6C8B44DB7B330AA59A |
SSDEEP: | 24576:NRkGRm91A+IEp482GVRE8MlSJAL2hdTRMc+8pvrYu:NjRwOEp4OVW6+L2bj+WTYu |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | - |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:09:19 08:48:13 |
ZipCRC: | 0x63548da6 |
ZipCompressedSize: | 902409 |
ZipUncompressedSize: | 905216 |
ZipFileName: | LimeCrypter.exe |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3544 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\1.zip" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
4088 | "C:\Users\admin\Desktop\LimeCrypter.exe" | C:\Users\admin\Desktop\LimeCrypter.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 0.0.0.0 | ||||
3636 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | LimeCrypter.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3512 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | — | RegAsm.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
3392 | "C:\Users\admin\AppData\Local\Temp\tmpFB1E.tmp.exe" | C:\Users\admin\AppData\Local\Temp\tmpFB1E.tmp.exe | — | RegAsm.exe |
User: admin Integrity Level: MEDIUM Version: 1.0.0.0 | ||||
3860 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | — | RegAsm.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Exit code: 0 Version: 4.7.3062.0 built by: NET472REL1 | ||||
2748 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | RegAsm.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Assembly Registration Utility Version: 4.7.3062.0 built by: NET472REL1 |
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\1.zip | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (3544) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (3636) RegAsm.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (3636) RegAsm.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3544 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3544.20239\LimeCrypter.exe | executable | |
MD5:9B634D298EFC4031B664838600244E2C | SHA256:A44BA2785C64A4F80EC66C6E9304C37BB1BB8CDAB1006BF73614EFAA49950141 | |||
3636 | RegAsm.exe | C:\Users\admin\AppData\Local\Temp\tmpFB1E.tmp.exe | executable | |
MD5:02E9009320FD3BB171797B7A80F3E86D | SHA256:E9955DB377BCA78AD23F2D941E536D63F50E4585AFFEB81B144BC6F7C1FA96BC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 185.194.141.58:80 | http://ip-api.com/json/ | DE | text | 286 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 121.44.52.211:49178 | — | Internode Pty Ltd | AU | malicious |
— | — | 185.194.141.58:80 | ip-api.com | netcup GmbH | DE | unknown |
Domain | IP | Reputation |
---|---|---|
ip-api.com |
| shared |
PID | Process | Class | Message |
---|---|---|---|
2748 | RegAsm.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
2748 | RegAsm.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
2748 | RegAsm.exe | A Network Trojan was detected | REMOTE [PTsecurity] Quasar.RAT IP Lookup |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |
2748 | RegAsm.exe | A Network Trojan was detected | MALWARE [PTsecurity] Quasar RAT |