analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

New folder (2).zip

Full analysis: https://app.any.run/tasks/1dc3566b-7852-4e0f-8fab-42b8d2f5b8c8
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Analysis date: July 12, 2020, 15:58:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
quasar
evasion
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

52DB15D48A6807EDC9A0CE8AF4ADCC46

SHA1:

2E59A16A0D485EA539CDA56163EAA6302C960206

SHA256:

C5B861C2995D96F9AC8545FBDE4F2B2E3EBFA0E078B4C839089561240F0DAE5F

SSDEEP:

3072:z1DWXjEctaotj9F830BfBwYT0ewkjEqOWyoMjsuojjd0caBTuWpRdAO8qp8u:z1WzEvotj9F8ofc6ENonj5HagA6u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Subfile.exe (PID: 2252)
    • Drops/Copies Quasar RAT executable

      • WinRAR.exe (PID: 1816)
    • QUASAR was detected

      • Subfile.exe (PID: 2252)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1816)
    • Creates files in the user directory

      • Subfile.exe (PID: 2252)
    • Checks for external IP

      • Subfile.exe (PID: 2252)
  • INFO

    • Manual execution by user

      • Subfile.exe (PID: 2252)
    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 1816)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Subfile.exe
ZipUncompressedSize: 356352
ZipCompressedSize: 184184
ZipCRC: 0xca7b17ab
ZipModifyDate: 2020:04:12 10:49:06
ZipCompression: Unknown (99)
ZipBitFlag: 0x0009
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe #QUASAR subfile.exe

Process information

PID
CMD
Path
Indicators
Parent process
1816"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\New folder (2).zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2252"C:\Users\admin\Desktop\Subfile.exe" C:\Users\admin\Desktop\Subfile.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Total events
473
Read events
451
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
2252Subfile.exeC:\Users\admin\AppData\Roaming\Logs\07-12-2020gpg
MD5:0A5DE5D19BF0A824A029B345F2EAD04D
SHA256:7EF8F861F8E7C04456EF2EEB1436292EA4B00119A960065F44F7A3EB0A9DBEBE
1816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1816.36678\Subfile.exeexecutable
MD5:0FAD3FE9F156F4FC3BE5DDC9B2BE3C45
SHA256:9575D5672850F340345760AEFEED96CFB260F2C2179F931DBA67712F20875683
1816WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1816.36678\Sys32.exeexecutable
MD5:B1573E75E10483D930AED66D639877E7
SHA256:5766A0BFC28184AFE968502F41747010915718E69D90ACEF39D68D459BC0D433
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2252
Subfile.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
281 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2252
Subfile.exe
208.95.112.1:80
ip-api.com
IBURST
malicious
2252
Subfile.exe
45.80.151.39:60002
suspicious

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
2252
Subfile.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2252
Subfile.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2252
Subfile.exe
A Network Trojan was detected
REMOTE [PTsecurity] Quasar.RAT IP Lookup
1 ETPRO signatures available at the full report
No debug info