analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

SubSeven S.A.T 1.0.7.rar

Full analysis: https://app.any.run/tasks/9185cc1b-e527-4a0b-9964-6a089e8d236c
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Analysis date: March 10, 2019, 19:03:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
quasar
browserloot
evasion
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B85AEA526843A6CCB23D8A25E2859095

SHA1:

656F8A2D9F95D199EBBD6EC7C695590816A05069

SHA256:

39CF91175D8AB9B6DB693FBDDD845ADE6AD14EF5BFC5432DBE92CC5971CEFCEE

SSDEEP:

6144:oMNm6dAruZW6m4uo1WYBkCk9hrHcKjEtZSLKTE8Lr/4JwjNpLrQlqcS5OmP:o4m6OHSkCk3vjEtcOThLb4ANpLTBOmP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • Connects to CnC server

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • Actions looks like stealing of personal data

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • QUASAR was detected

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • Stealing of credential data

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
  • SUSPICIOUS

    • Reads Environment values

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • Reads the cookies of Google Chrome

      • SubSeven S.A.T 1.0.7.exe (PID: 3016)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2696)
  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3796)
    • Creates files in the user directory

      • WINWORD.EXE (PID: 3796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
32
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe #QUASAR subseven s.a.t 1.0.7.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2696"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SubSeven S.A.T 1.0.7.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3016"C:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\SubSeven S.A.T 1.0.7.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\SubSeven S.A.T 1.0.7.exe
WinRAR.exe
User:
admin
Company:
SubSeven Inc.
Integrity Level:
MEDIUM
Description:
SubSeven S.A.T 1.0.7
Exit code:
0
Version:
1.0.7
3796"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\cnetindependent.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Total events
1 077
Read events
988
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1
Text files
14
Unknown types
4

Dropped files

PID
Process
Filename
Type
3796WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR31A0.tmp.cvr
MD5:
SHA256:
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\SubSeven S.A.T 1.0.7.exeexecutable
MD5:B650ECA967D91F682B8690B9AB5C287A
SHA256:21C0829B0BFAB46113D6252BEDF883CFFDCD6D87789A76056127784F5EFF3762
3016SubSeven S.A.T 1.0.7.exeC:\Users\admin\AppData\Local\Temp\e6f3475a-6185-4267-83f6-71b58a7d05c7_chrome.txttext
MD5:A416BE74FF10403242D959EE6A3B01E2
SHA256:82B5238C970BADF9EFD8B3343CA88E183412541AAEB43B4CDF522990351335C0
3796WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:27388BD434655F67141A8B2086FEB81D
SHA256:74B09EDE851AEFF4F4214A17981974BE6BE01CBF233D685136736F6A039B5787
3796WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\cnetindependent.rtf.LNKlnk
MD5:873A3783FA06D76D78EC8A68AB9C45A1
SHA256:A671757DA00A259746EFC687BB99B47E32F6F3491D9DE481FA66E2EFFC9F6134
3796WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:00AC35F367400CB6807E3CD3CB5032E1
SHA256:8BE7B71A35F5736D9DCA0FEBF091DAEB9C97BEDF733726EB005C6B1F003BC137
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\Configuration\networkcontrol.initext
MD5:7E9F5A0E02F7B2B8654CABA1364A01B3
SHA256:2A4B016BB7792CDB46BDC0075BCC0EE846046204BC1A87455B7BA9266B9CCC58
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\Configuration\FileSearcher.initext
MD5:075AE3D2FC31640504F814F60E5EF713
SHA256:17EB3C0168D0D7B21EDE5481150F17233427D89833EC121B4DBC4FB96CFAB71E
3016SubSeven S.A.T 1.0.7.exeC:\Users\admin\AppData\Local\Temp\4147af6d-4916-4fc1-9485-6a1753c51244_ccookies.txttext
MD5:BF4671EB8331ACB10ED1162394DAB2A4
SHA256:80E4C23E8B7200F1F75CE0DEAEE3B90F62FB458226231AED5AEFC1443E07C832
2696WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2696.12905\SubSeven S.A.T 1.0.7\Configuration\settings.initext
MD5:E6CEE1AAE2E0FADF069888784E9207A9
SHA256:F891459C922E178C9EF398474160654C90B6A9FFC4DD3B148BA18FEFFB664F5F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3016
SubSeven S.A.T 1.0.7.exe
GET
301
104.31.76.103:80
http://browserloot.rokey.xyz/api/get-ip.php
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3016
SubSeven S.A.T 1.0.7.exe
104.31.77.103:443
browserloot.rokey.xyz
Cloudflare Inc
US
shared
3016
SubSeven S.A.T 1.0.7.exe
104.31.76.103:80
browserloot.rokey.xyz
Cloudflare Inc
US
shared
3016
SubSeven S.A.T 1.0.7.exe
104.31.76.103:443
browserloot.rokey.xyz
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
browserloot.rokey.xyz
  • 104.31.76.103
  • 104.31.77.103
malicious
rokey.xyz
  • 104.31.77.103
  • 104.31.76.103
malicious

Threats

PID
Process
Class
Message
3016
SubSeven S.A.T 1.0.7.exe
A Network Trojan was detected
MALWARE [PTsecurity] BrowserLoot Stealer
3016
SubSeven S.A.T 1.0.7.exe
A Network Trojan was detected
MALWARE [PTsecurity] BrowserLoot Stealer Connection
2 ETPRO signatures available at the full report
No debug info