File name:

craxsRat V6.7z

Full analysis: https://app.any.run/tasks/92d6437a-0894-43b8-86cc-f1fd326f0e67
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: January 20, 2024, 20:29:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
quasar
redline
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

CC85AC83575E10053C1F5B14A7728E44

SHA1:

9172361508DE14B578D84F42C1FCB399123D27B0

SHA256:

9ED635587BCE97B3DD2DEC67AA1950853F72741B00682F284826932B9873E3B2

SSDEEP:

98304:uFaN86wHKWROj5binfzlhhdHwe8r6t6DJDIYFOjwFRhAMJ7gGal53PyaWsbFIeco:KmkVwQOn+glTDCaoxHsg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • CraxsRAT.exe (PID: 296)
      • WinRAR.exe (PID: 2184)

    • Changes the autorun value in the registry

      • Client.exe (PID: 2076)

    • QUASAR has been detected (YARA)

      • Client.exe (PID: 2076)

    • REDLINE has been detected (YARA)

      • craxsrat_loader.exe (PID: 2480)
      • craxsrat_loader.exe (PID: 668)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2184)

    • Executable content was dropped or overwritten

      • CraxsRAT.exe (PID: 296)

    • Starts itself from another location

      • CraxsRAT.exe (PID: 296)

    • Connects to unusual port

      • Client.exe (PID: 2076)
      • craxsrat_loader.exe (PID: 2480)
      • craxsrat_loader.exe (PID: 668)

  • INFO

    • Checks supported languages

      • CraxsRAT.exe (PID: 296)
      • Client.exe (PID: 2076)
      • craxsrat_loader.exe (PID: 668)
      • CraxsRAT.exe (PID: 2444)
      • craxsrat_loader.exe (PID: 2480)

    • Reads the computer name

      • CraxsRAT.exe (PID: 296)
      • Client.exe (PID: 2076)
      • craxsrat_loader.exe (PID: 668)
      • CraxsRAT.exe (PID: 2444)
      • craxsrat_loader.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2184)

    • Reads Environment values

      • CraxsRAT.exe (PID: 296)
      • Client.exe (PID: 2076)
      • CraxsRAT.exe (PID: 2444)

    • Reads the machine GUID from the registry

      • CraxsRAT.exe (PID: 296)
      • Client.exe (PID: 2076)
      • craxsrat_loader.exe (PID: 668)
      • CraxsRAT.exe (PID: 2444)
      • craxsrat_loader.exe (PID: 2480)

    • Creates files or folders in the user directory

      • CraxsRAT.exe (PID: 296)
      • Client.exe (PID: 2076)

    • Manual execution by a user

      • taskmgr.exe (PID: 2584)
      • craxsrat_loader.exe (PID: 2480)
      • CraxsRAT.exe (PID: 2444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(2076) Client.exe
Version1.4.1
C2 (4)109.123.239.168:4782
45.92.1.39:4782
192.227.190.146:4782
Sub_DirGoogle Extensions
Install_NameClient.exe
Mutex10726cc3-bb08-45ab-bcfa-a1a801fe7c81
Startupmsdrvhost
TagMETRO
LogDirLogs
SignatureHAxXbimAGnaTkfgoebpxWbg+rHb9waAPcK75aNCAeHrKINdrbHOVWdMYYcnnVrVPRBgdzMwUIcFnCpoUgWeykEmJaBkX26ad9i6VhFVsAdjR8ctFLSbrSrqLKU5Laki2VZjp2AhKLca3ZRxKP47Z4AknN16f3ViOxa48A8DiGWN4goWf2lx3o7/sE/O36lnrkt63kw/kgiDTdNYhXDJh7wpETBtrgsTZuRPbMzdpCtar4FTg6y1wDxTpGTz8+d87EtHQ7mYGYHqzryJ+mfDxuL/gQlVY22W8sEKlVLJI+Qq/...
CertificateMIIE9DCCAtygAwIBAgIQAJXwinK/ak+poCze5rYYvzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDgyNTE4MTUxMloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjdOD746SUknaqDyFaiaG/ruicBZF669xHbCQ62NRm12SA56yGSzuqI62D04PyXXNZJCQ6Own...
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe craxsrat.exe #QUASAR client.exe #REDLINE craxsrat_loader.exe #REDLINE craxsrat_loader.exe craxsrat.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\CraxsRAT.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\CraxsRAT.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
3
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2184.7175\craxsrat v6\craxs\craxsrat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
668"C:\Users\admin\AppData\Local\Temp\Rar$EXa2184.9042\craxsRat V6\craxs\craxsrat_loader.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2184.9042\craxsRat V6\craxs\craxsrat_loader.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Exit code:
0
Version:
15.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2184.9042\craxsrat v6\craxs\craxsrat_loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2076"C:\Users\admin\AppData\Roaming\Google Extensions\Client.exe"C:\Users\admin\AppData\Roaming\Google Extensions\Client.exe
CraxsRAT.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\roaming\google extensions\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(2076) Client.exe
Version1.4.1
C2 (4)109.123.239.168:4782
45.92.1.39:4782
192.227.190.146:4782
Sub_DirGoogle Extensions
Install_NameClient.exe
Mutex10726cc3-bb08-45ab-bcfa-a1a801fe7c81
Startupmsdrvhost
TagMETRO
LogDirLogs
SignatureHAxXbimAGnaTkfgoebpxWbg+rHb9waAPcK75aNCAeHrKINdrbHOVWdMYYcnnVrVPRBgdzMwUIcFnCpoUgWeykEmJaBkX26ad9i6VhFVsAdjR8ctFLSbrSrqLKU5Laki2VZjp2AhKLca3ZRxKP47Z4AknN16f3ViOxa48A8DiGWN4goWf2lx3o7/sE/O36lnrkt63kw/kgiDTdNYhXDJh7wpETBtrgsTZuRPbMzdpCtar4FTg6y1wDxTpGTz8+d87EtHQ7mYGYHqzryJ+mfDxuL/gQlVY22W8sEKlVLJI+Qq/...
CertificateMIIE9DCCAtygAwIBAgIQAJXwinK/ak+poCze5rYYvzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTIzMDgyNTE4MTUxMloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAjdOD746SUknaqDyFaiaG/ruicBZF669xHbCQ62NRm12SA56yGSzuqI62D04PyXXNZJCQ6Own...
2184"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\craxsRat V6.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2444"C:\Users\admin\Desktop\CraxsRAT.exe" C:\Users\admin\Desktop\CraxsRAT.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
2
Version:
1.4.1
Modules
Images
c:\users\admin\desktop\craxsrat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2480"C:\Users\admin\Desktop\craxsrat_loader.exe" C:\Users\admin\Desktop\craxsrat_loader.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Nirtro CPU
Exit code:
0
Version:
15.9.1.22
Modules
Images
c:\users\admin\desktop\craxsrat_loader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2584"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
3 927
Read events
3 860
Write events
67
Delete events
0

Modification events

(PID) Process:(2184) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
30
Suspicious files
11
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\CraxsRat.exe.configxml
MD5:7AE229700EFC323E33897AD95588BF2D
SHA256:DB3E864A56DEA1C786CBF5DD9CD73524259EF4CE442B27F86D6EC9F7AF581593
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\LiveCharts.WinForms.pdbpdb
MD5:75AC1D35A79DB3ED5810097BACD498FF
SHA256:26021AA51EAB1B7E82EFC702EF39DC6180F144415BC0A14CCACE060DAD555C77
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\Errorlogs.txttext
MD5:842CD9110FD7AC5F8FFD0403A21B2766
SHA256:9ECAB9EEFA25DD6FA375C9940048D221029D6D532250A739DF4360400A1714CC
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\World.xmlxml
MD5:28A1E2B477EBE7DE49DF597A4117C28E
SHA256:CBD20C5CCC5B11718B782547BB5B818FE368168C1794B2254FED7333959757DA
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\CraxsRAT.exeexecutable
MD5:91B64C75D01266C4517DCE67F9C999E0
SHA256:9683F82A11711238BB9E9484854334D9D1AF93594182DE5F7E86126C9F23CD4E
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\DrakeUI.Framework.dllexecutable
MD5:0562B4C97F643306DF491A938AE636DA
SHA256:70E72477F7FE0018E043CE8FE2228A289459058EE41CAECD6F05855898BC5B80
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\GeoIPCitys.dllexecutable
MD5:C070F2421851420E832E4F5989A775A2
SHA256:D54FD6C5903EEA49A75D620D4BA232F8EFFB1863F5F9C974E4AC0A8FB1904131
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\LiveCharts.MAPS.dllexecutable
MD5:DFEE15E4C6EFA37E6645D8B47C8581E0
SHA256:5B8A9A04F454A2C4DA5989FA454A0138D3E5C40712816600F90111B7BF045C40
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\Config.jsontext
MD5:EE3FC1A27DF0F05DF3BC938818B42F50
SHA256:DF5E911E4EAF909E7BD6B89F7B9B679C9D928AEE34416B06E34BB7420B9D890D
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2184.7175\craxsRat V6\craxs\LiveCharts.Wpf.pdbpdb
MD5:F209A4302B929A36DD534DC48DFDC617
SHA256:718FF471C7CCFA31E9CF905DFA01C9925D692835EA646E95754FD801A5EE4CA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
72
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2076
Client.exe
109.123.239.168:4782
—
CASABLANCA INT a.s.
CZ
unknown
2076
Client.exe
45.92.1.39:4782
—
1337 Services GmbH
BR
unknown
668
craxsrat_loader.exe
45.92.1.32:20580
—
1337 Services GmbH
BR
malicious
2076
Client.exe
192.227.190.146:4782
—
AS-COLOCROSSING
US
unknown
2480
craxsrat_loader.exe
45.92.1.32:20580
—
1337 Services GmbH
BR
malicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
craxsRat V6.7z