Try VMRay Platform
Malicious
Classifications

Injector Spyware Backdoor Keylogger

Threat Names

Quasar xRAT QuasarRAT AZORult +8

Dynamic Analysis Report

Created on 2021-09-28T10:14:00

efacb905cbe59645ce57ea6ac46d32add5f48278aefd411bf4f53116ca0fb0e0.exe

Windows Exe (x86-32)

Remarks (2/3)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "2 minutes, 45 seconds" to "2 seconds" to reveal dormant functionality.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

(0x0200003A): A task was rescheduled ahead of time to reveal dormant functionality.

General

0.91 KB total sent
1.09 KB total received
3 ports: 80 , 443 , 8000
4 contacted IP addresses
0 URLs extracted
0 files downloaded
0 malicious hosts detected

DNS

3 DNS requests for 2 domains
1 nameserver contacted
1 total requests returned errors

HTTP/S

2 URLs contacted, 2 servers
3 sessions, 0.91 KB sent, 1.09 KB received
Function Logfile
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Before

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
After

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".


    
Screenshot
Expand-Icon
Exit-Icon
icon_left
icon_left
image