Overview

overview

10

Static

static

a0824896a6...c1.exe

windows7_x64

10

a0824896a6...c1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1

  • Size

    1.0MB

  • Sample

    210922-qk4vmscgd7

  • MD5

    d9ae9f8e6be0c1d7c70a1d1b86f44a8c

  • SHA1

    1564057c68ed04ffe76aa192e867ed40cd868840

  • SHA256

    a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1

  • SHA512

    d13a512177f86e9a3de60c6b525175005870d5c1536f9e2af80da0c881314d3833b7140e777c65950d71053907f4608237f595490372e5e003fc9c3925786e2b

Score
10/10
quasarvenom clientmicrosoftphishingspywaretrojan

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Venom Client

C2

192.168.0.149:4455

Mutex

PNMCyu2XSzVny0gdTw

Attributes
  • encryption_key

    aPDdCEtQpHs1yTAHJZ1B

  • install_name

    Venom.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

Targets

    • Target

      a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1

    • Size

      1.0MB

    • MD5

      d9ae9f8e6be0c1d7c70a1d1b86f44a8c

    • SHA1

      1564057c68ed04ffe76aa192e867ed40cd868840

    • SHA256

      a0824896a6cb88bb0459cd54f5085056cfd2c9733b5cdc75623615e5d61f86c1

    • SHA512

      d13a512177f86e9a3de60c6b525175005870d5c1536f9e2af80da0c881314d3833b7140e777c65950d71053907f4608237f595490372e5e003fc9c3925786e2b

    Score
    10/10
    quasarvenom clientspywaretrojanmicrosoftphishing

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Detected potential entity reuse from brand microsoft.

      phishingmicrosoft

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks