Overview

overview

10

Static

static

857e38c608...ff.exe

windows7_x64

10

857e38c608...ff.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    857e38c6089c96d19061c1df7b39a22d42b8962e065b6b652a8a3c2246c7bdff

  • Size

    401KB

  • Sample

    220312-v1lq8abafn

  • MD5

    e514b9b328bcebbfafc9a9f9bded8324

  • SHA1

    45e608a882de0a203ddde9ff5efa2b79ca48350c

  • SHA256

    857e38c6089c96d19061c1df7b39a22d42b8962e065b6b652a8a3c2246c7bdff

  • SHA512

    548698b0f45b5e080ea7a9903f51399290c11f9f31e3633351d48304ddba5363a1065a8f32114db124963827e902558cdab4f0ca9ca26b4ba118e46b16b4a703

Score
10/10
quasarrevengeratzenoxpuspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.0

Botnet

ZenoXpu

C2

185.153.222.198:7845

Mutex

HIFbOBRX8hIfqiy4wu

Attributes
  • encryption_key

    DQXvqTzM5uyODUsZK174

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      857e38c6089c96d19061c1df7b39a22d42b8962e065b6b652a8a3c2246c7bdff

    • Size

      401KB

    • MD5

      e514b9b328bcebbfafc9a9f9bded8324

    • SHA1

      45e608a882de0a203ddde9ff5efa2b79ca48350c

    • SHA256

      857e38c6089c96d19061c1df7b39a22d42b8962e065b6b652a8a3c2246c7bdff

    • SHA512

      548698b0f45b5e080ea7a9903f51399290c11f9f31e3633351d48304ddba5363a1065a8f32114db124963827e902558cdab4f0ca9ca26b4ba118e46b16b4a703

    Score
    10/10
    quasarzenoxpuspywaretrojanrevengerat

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks