File name:

QuasarRAT.exe

Full analysis: https://app.any.run/tasks/1b356737-9320-48a7-828f-c698832ce81d
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: April 19, 2025, 09:41:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
azorult
sinkhole
loader
evasion
quasar
autoit
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

78F75D3EE49C612A1B47A095D8B41108

SHA1:

158EB8383DDF8064FDC119053E5755923FDEB5D8

SHA256:

773A219EB43AF7FB4A56992E11871DBD3463ACAE0F7A82F12EFA25AC84248D13

SSDEEP:

98304:GAGQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRp:z1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AZORULT mutex has been detected

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Uses Task Scheduler to run other applications

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • Connects to the CnC server

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • QUASAR mutex has been found

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)

    • AZORULT has been detected (SURICATA)

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Request for a sinkholed resource

      • QuasarRAT.exe (PID: 3192)

    • Changes the autorun value in the registry

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • QUASAR has been detected (YARA)

      • QuasarRAT.exe (PID: 3020)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • winsock.exe (PID: 6540)

    • Executable content was dropped or overwritten

      • QuasarRAT.exe (PID: 3020)
      • windef.exe (PID: 5256)

    • Application launched itself

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • Executes application which crashes

      • vnc.exe (PID: 6620)
      • vnc.exe (PID: 7396)
      • winsock.exe (PID: 6540)

    • Contacting a server suspected of hosting an CnC

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • Starts itself from another location

      • windef.exe (PID: 5256)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • Connects to unusual port

      • QuasarRAT.exe (PID: 3192)
      • SystemPropertiesPerformance.exe (PID: 7496)

    • The process executes via Task Scheduler

      • SystemPropertiesPerformance.exe (PID: 7352)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7836)

    • Starts CMD.EXE for commands execution

      • winsock.exe (PID: 6540)

    • Executing commands from a ".bat" file

      • winsock.exe (PID: 6540)

    • The executable file from the user directory is run by the CMD process

      • winsock.exe (PID: 8012)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7836)

  • INFO

    • The sample compiled with english language support

      • QuasarRAT.exe (PID: 3020)

    • Reads mouse settings

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)

    • Create files in a temporary directory

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)

    • Reads the computer name

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)

    • Reads the machine GUID from the registry

      • QuasarRAT.exe (PID: 3020)
      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)

    • Process checks computer location settings

      • QuasarRAT.exe (PID: 3020)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • winsock.exe (PID: 6540)

    • Checks supported languages

      • QuasarRAT.exe (PID: 3020)
      • vnc.exe (PID: 6620)
      • windef.exe (PID: 5256)
      • QuasarRAT.exe (PID: 3192)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7352)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • vnc.exe (PID: 7396)
      • windef.exe (PID: 7428)
      • winsock.exe (PID: 8012)
      • chcp.com (PID: 7908)

    • Checks proxy server information

      • QuasarRAT.exe (PID: 3192)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • SystemPropertiesPerformance.exe (PID: 7496)
      • winsock.exe (PID: 8012)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 300)
      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • WerFault.exe (PID: 7480)
      • WerFault.exe (PID: 7944)

    • Disables trace logs

      • windef.exe (PID: 5256)
      • winsock.exe (PID: 6540)
      • winsock.exe (PID: 8012)

    • The process uses AutoIt

      • QuasarRAT.exe (PID: 3020)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:12 13:38:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1527296
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Adobe Download Manager
OriginalFileName: Adobe Download Manager
CompanyName: Adobe Systems Incorporated
FileVersion: ...
LegalCopyright: Copyright 2018 Adobe Incorporated. All rights reserved.
ProductName: Adobe Download Manager
ProductVersion: ...
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
26
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR quasarrat.exe vnc.exe svchost.exe no specs #QUASAR windef.exe #AZORULT quasarrat.exe schtasks.exe no specs conhost.exe no specs werfault.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe no specs #QUASAR winsock.exe systempropertiesperformance.exe no specs vnc.exe svchost.exe no specs #QUASAR windef.exe no specs werfault.exe no specs #AZORULT systempropertiesperformance.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe no specs #QUASAR winsock.exe

Process information

PID
CMD
Path
Indicators
Parent process
300C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6620 -s 592C:\Windows\SysWOW64\WerFault.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3020"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe" C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\quasarrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
3192"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe"C:\Users\admin\AppData\Local\Temp\QuasarRAT.exe
QuasarRAT.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\appdata\local\temp\quasarrat.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4880C:\WINDOWS\system32\svchost.exe -kC:\Windows\System32\svchost.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
4892C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4976"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /FC:\Windows\SysWOW64\schtasks.exe—QuasarRAT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5164"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5256"C:\Users\admin\AppData\Local\Temp\windef.exe" C:\Users\admin\AppData\Local\Temp\windef.exe
QuasarRAT.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windef.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
12 903
Read events
12 866
Write events
37
Delete events
0

Modification events

(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3192) QuasarRAT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5256) windef.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\windef_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
4
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
300WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_c260b12b-b723-4ec0-bb01-5fbf4da1df6c\Report.wer —
MD5:—
SHA256:—
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_5ae4957f-4540-4c58-804f-1b802abb9ba2\Report.wer —
MD5:—
SHA256:—
7944WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_winsock.exe_4ec29f32368eb0b92941df6619f6579b4b16f5a8_e8bd1e0d_0159e100-1f6d-4689-8b21-7b165e972aa3\Report.wer —
MD5:—
SHA256:—
7944WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\winsock.exe.6540.dmp —
MD5:—
SHA256:—
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2DB.tmp.dmpbinary
MD5:A300AD4BCFAB5DE5775094C456583147
SHA256:CA397F5C8593390B7DDAED54654A4CE5ECC0441D6471A886D4A30C4A2F3ED6BF
6540winsock.exeC:\Users\admin\AppData\Roaming\Logs\04-19-2025binary
MD5:44C1FC69AD88A3D487E90E4A5013FCC2
SHA256:313DE926E6C1C7A8218E3C2C06880D862A5BD22439F6EA88AD9463D0A9517EF6
3020QuasarRAT.exeC:\Users\admin\btpanui\SystemPropertiesPerformance.exeexecutable
MD5:B0828CD0E21C90652B258A29DD5814CC
SHA256:1EE246575CFFF910B2B6649C8B1351B8CFF5134F504D08B4714DE89FBD3423DC
7480WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER34B.tmp.xmlxml
MD5:C5AC78E2E9919B90C4F7931440EDF0DE
SHA256:CDBF9CD3AB4A847C13F4AB6047F8225BF958232490A09562125DC024DF7E09AA
5256windef.exeC:\Users\admin\AppData\Roaming\SubDir\winsock.exeexecutable
MD5:B4A202E03D4135484D0E730173ABCC72
SHA256:7050608D53F80269DF951D00883ED79815C060CE7678A76B5C3F6A2A985BEEA9
300WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERC095.tmp.xmlxml
MD5:3C1F33D41041137D95B78DD789BCB01E
SHA256:A02952A905BC433AE1CCAADDDD47B92A9BDE6BBC3C258CADF5F31F286CDFA05A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
26
DNS requests
16
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3192
QuasarRAT.exe
POST
200
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
3192
QuasarRAT.exe
POST
—
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
5256
windef.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6540
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
7748
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7748
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8012
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
7496
SystemPropertiesPerformance.exe
POST
—
3.229.117.57:8000
http://0x21.in:8000/_az/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3192
QuasarRAT.exe
3.229.117.57:8000
0x21.in
AMAZON-AES
US
malicious
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5256
windef.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6540
winsock.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6540
winsock.exe
5.8.88.191:443
—
PINVDS OU
RU
malicious
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
whitelisted
google.com
  • 142.250.186.174
whitelisted
0x21.in
  • 3.229.117.57
malicious
client.wns.windows.com
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.131
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.64
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted

Threats

PID
Process
Class
Message
3192
QuasarRAT.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
3192
QuasarRAT.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
3192
QuasarRAT.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
3192
QuasarRAT.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5256
windef.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
5256
windef.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6540
winsock.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6540
winsock.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
QuasarRAT.exe