File name:

ConsoleSniffer v3 - Password is bob

Full analysis: https://app.any.run/tasks/e4483d43-e35d-4f81-bfb3-cefa687b4317
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: May 20, 2022, 16:10:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
quasar
evasion
trojan
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

FEC028CA2FB7F3342B756F26FA329D92

SHA1:

C4B83D141DBE3116CD2B1CE71F2C1A45CBBF12BD

SHA256:

746BB20E63673B15720E6430186EA787422E4DE6E3A7FBA1D9B8799A30970754

SSDEEP:

196608:yts0F/7CrHvJW+0sdG1pV4TA7wkdtnv3baSqPoI6KJ:EZFCLy7WTA7wOcSqQI6KJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • ConsoleSniffer.exe (PID: 1780)
      • WinRAR.exe (PID: 2992)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • WindowsStartup.exe (PID: 3000)

    • Application was dropped or rewritten from another process

      • ConsoleSniffer.exe (PID: 1780)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • ConsoleSniffer v3.exe (PID: 2344)
      • ConsoleSniffer v3.exe (PID: 3040)
      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)
      • ConsoleSniffer.exe (PID: 3560)
      • boom.exe (PID: 2076)
      • test.exe (PID: 1556)
      • ConsoleSniffer v3.exe (PID: 2228)
      • ConsoleSniffer v3.exe (PID: 2852)
      • WindowsStartup.exe (PID: 3252)

    • Drops/Copies Quasar RAT executable

      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • WindowsStartup.exe (PID: 3000)

    • Writes to the hosts file

      • ConsoleSniffer v3.exe (PID: 3040)

    • Changes the autorun value in the registry

      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)

    • Disables Windows Defender

      • regedit.exe (PID: 3832)
      • regedit.exe (PID: 3740)

    • QUASAR detected by memory dumps

      • WindowsRun.exe (PID: 2036)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2992)
      • ConsoleSniffer.exe (PID: 1780)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • WindowsStartup.exe (PID: 3000)

    • Checks supported languages

      • WinRAR.exe (PID: 2992)
      • ConsoleSniffer.exe (PID: 1780)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • ConsoleSniffer v3.exe (PID: 3040)
      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)
      • ConsoleSniffer.exe (PID: 3560)
      • boom.exe (PID: 2076)
      • ConsoleSniffer v3.exe (PID: 2852)
      • WindowsStartup.exe (PID: 3252)
      • test.exe (PID: 1556)

    • Reads the computer name

      • WinRAR.exe (PID: 2992)
      • ConsoleSniffer.exe (PID: 1780)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • ConsoleSniffer v3.exe (PID: 3040)
      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)
      • ConsoleSniffer.exe (PID: 3560)
      • boom.exe (PID: 2076)
      • WindowsStartup.exe (PID: 3252)
      • ConsoleSniffer v3.exe (PID: 2852)
      • test.exe (PID: 1556)

    • Drops a file with a compile date too recent

      • ConsoleSniffer.exe (PID: 1780)
      • WinRAR.exe (PID: 2992)
      • boom.exe (PID: 1632)
      • test.exe (PID: 908)
      • WindowsStartup.exe (PID: 3000)

    • Reads Environment values

      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)

    • Creates files in the user directory

      • WindowsStartup.exe (PID: 3000)

    • Checks for external IP

      • WindowsStartup.exe (PID: 3000)
      • WindowsRun.exe (PID: 2036)

    • Starts itself from another location

      • WindowsStartup.exe (PID: 3000)

  • INFO

    • Reads the hosts file

      • ConsoleSniffer v3.exe (PID: 3040)
      • ConsoleSniffer v3.exe (PID: 2852)

    • Checks supported languages

      • regedit.exe (PID: 3832)
      • regedit.exe (PID: 3740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(2036) WindowsRun.exe
Version1.3.0.0
C2 (2)185.217.1.170:56098
Sub_DirWindowsRep
Install_NameWindowsRun.exe
MutexQSR_MUTEX_mXJYTiCQWK23RFk8eh
StartupWindowsRuntiime
TagTarget
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
18
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe consolesniffer.exe boom.exe test.exe consolesniffer v3.exe no specs consolesniffer v3.exe windowsstartup.exe regedit.exe no specs regedit.exe #QUASAR windowsrun.exe consolesniffer.exe no specs boom.exe no specs test.exe no specs consolesniffer v3.exe no specs consolesniffer v3.exe windowsstartup.exe no specs regedit.exe no specs regedit.exe

Process information

PID
CMD
Path
Indicators
Parent process
908"C:\Users\admin\AppData\Local\Temp\test.exe" C:\Users\admin\AppData\Local\Temp\test.exe
boom.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\test.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1556"C:\Users\admin\AppData\Local\Temp\test.exe" C:\Users\admin\AppData\Local\Temp\test.exe—boom.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\test.exe
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1632"C:\Users\admin\AppData\Local\Temp\boom.exe" C:\Users\admin\AppData\Local\Temp\boom.exe
ConsoleSniffer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\boom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1780"C:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\ConsoleSniffer\ConsoleSniffer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\ConsoleSniffer\ConsoleSniffer.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2992.23360\consolesniffer v3\consolesniffer\consolesniffer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2036"C:\Users\admin\AppData\Roaming\WindowsRep\WindowsRun.exe"C:\Users\admin\AppData\Roaming\WindowsRep\WindowsRun.exe
WindowsStartup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\windowsrep\windowsrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(2036) WindowsRun.exe
Version1.3.0.0
C2 (2)185.217.1.170:56098
Sub_DirWindowsRep
Install_NameWindowsRun.exe
MutexQSR_MUTEX_mXJYTiCQWK23RFk8eh
StartupWindowsRuntiime
TagTarget
LogDirLogs
Signature
Certificate
2076"C:\Users\admin\AppData\Local\Temp\boom.exe" C:\Users\admin\AppData\Local\Temp\boom.exe—ConsoleSniffer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\boom.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2228"C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe" C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe—test.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
IP Grabber
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\consolesniffer v3.exe
c:\windows\system32\ntdll.dll
2344"C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe" C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe—test.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
IP Grabber
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\consolesniffer v3.exe
c:\windows\system32\ntdll.dll
2852"C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe" C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exe
test.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
IP Grabber
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\consolesniffer v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2992"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3 - Password is bob.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
Total events
7 340
Read events
7 192
Write events
148
Delete events
0

Modification events

(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2992) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3 - Password is bob.rar
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2992) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
27
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\ConsoleSniffer\ConsoleSniffer.exeexecutable
MD5:DF5A226B6C70691C85CBF776A17FD221
SHA256:7E5E87FAF066201221548D5A8912582D7CDFF43DAC06331B68AA81A072F8BD21
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\ConsoleSniffer\INFORMATIONS by lB_U_Z_Z_A_R_Dl.txttext
MD5:4F28D7FDB3DFA2A177C76389A4DD1CC3
SHA256:84C7DAA41D0B65F1D0AE6AD2813F1E7D6FD3565C78E9CBFA2D9C59100181045A
1632boom.exeC:\Users\admin\AppData\Local\Temp\test.exeexecutable
MD5:—
SHA256:—
1780ConsoleSniffer.exeC:\Users\admin\AppData\Local\Temp\boom.exeexecutable
MD5:—
SHA256:—
908test.exeC:\Users\admin\AppData\Local\Temp\ConsoleSniffer v3.exeexecutable
MD5:—
SHA256:—
3000WindowsStartup.exeC:\Users\admin\AppData\Roaming\WindowsRep\WindowsRun.exeexecutable
MD5:—
SHA256:—
908test.exeC:\Users\admin\AppData\Local\Temp\WindowsStartup.exeexecutable
MD5:—
SHA256:—
908test.exeC:\Users\admin\AppData\Local\Temp\Defender.regtext
MD5:—
SHA256:—
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\ConsoleSniffer\PcapDotNet.Core.Extensions.dllexecutable
MD5:BD02851517BA8A2252AE5F6588E8886E
SHA256:925B370A65D5135D1425027E5087BE62D098D822B9F2CECD840CD7EFA5397380
2992WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2992.23360\ConsoleSniffer v3\OPEN ME IF HAVING ERROR\ndp48-web.exeexecutable
MD5:86482F2F623A52B8344B00968ADC7B43
SHA256:2C7530EDBF06B08A0B9F4227C24EC37D95F3998EE7E6933AE22A9943D0ADFA57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
207
DNS requests
1
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
WindowsRun.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
286 b
malicious
3000
WindowsStartup.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
286 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
WindowsStartup.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2036
WindowsRun.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2036
WindowsRun.exe
185.217.1.170:56098
—
Icme Limited
SE
malicious
—
—
185.217.1.170:56098
—
Icme Limited
SE
malicious

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
malicious

Threats

PID
Process
Class
Message
3000
WindowsStartup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3000
WindowsStartup.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2036
WindowsRun.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2036
WindowsRun.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ConsoleSniffer v3 - Password is bob