Overview

overview

10

Static

static

75431a6683...f0.exe

windows7_x64

10

75431a6683...f0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75431a6683fad5d34da65ac5bf4f79dbeeb1be402bd5010d4b8ed4e2a2145ef0

  • Size

    430KB

  • Sample

    220420-emwfhaehek

  • MD5

    0b4a3956c5776695047b654f3cb9aa41

  • SHA1

    c1e273e4a064c60072a6b4ddf8a824b5e3e15f8f

  • SHA256

    75431a6683fad5d34da65ac5bf4f79dbeeb1be402bd5010d4b8ed4e2a2145ef0

  • SHA512

    3fd501a621944aef7040d558921f6dacc95a61d00e0fe485fa1d2493a1f0c0dc7a46049e38c125b1b583c25ce3297851e9e88e714440cc28187ce86eba2172fc

Score
10/10
quasarrazspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Raz

C2

tornoob.me:900

Mutex

QSR_MUTEX_d1O3bbvoVmFYPAM7rt

Attributes
  • encryption_key

    T288HhNTvZ5ItWMC1F2I

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      75431a6683fad5d34da65ac5bf4f79dbeeb1be402bd5010d4b8ed4e2a2145ef0

    • Size

      430KB

    • MD5

      0b4a3956c5776695047b654f3cb9aa41

    • SHA1

      c1e273e4a064c60072a6b4ddf8a824b5e3e15f8f

    • SHA256

      75431a6683fad5d34da65ac5bf4f79dbeeb1be402bd5010d4b8ed4e2a2145ef0

    • SHA512

      3fd501a621944aef7040d558921f6dacc95a61d00e0fe485fa1d2493a1f0c0dc7a46049e38c125b1b583c25ce3297851e9e88e714440cc28187ce86eba2172fc

    Score
    10/10
    quasarrazspywaretrojan

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks