Overview

overview

10

Static

static

a73eec95b2...52.exe

windows7_x64

10

a73eec95b2...52.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

  • Size

    1.2MB

  • Sample

    210228-aaxlal8fge

  • MD5

    b7c64961404b11332ce76a067eb3d1d0

  • SHA1

    7781a5b8c7d8f318514188d67b50000bcd022dfc

  • SHA256

    a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

  • SHA512

    72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

Score
10/10
quasarpersistencespywaretrojan

Malware Config

Targets

    • Target

      a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

    • Size

      1.2MB

    • MD5

      b7c64961404b11332ce76a067eb3d1d0

    • SHA1

      7781a5b8c7d8f318514188d67b50000bcd022dfc

    • SHA256

      a73eec95b2d0ed2fc3f2185b994f36e3b65963c4cfcb9328716de159d41f2452

    • SHA512

      72a07e85e05fa84aea2e7c691a42e2e4361ab2440520122e3b5d25ad79c66b8ee04db5172cc33e67083ece276504573513d3f84d76afc91e406ed9b17025d6c6

    Score
    10/10
    quasarpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks