Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    2.8MB

  • Sample

    220925-e2qhssdcb6

  • MD5

    c41aa4383be3c790c15b89ac0b52a046

  • SHA1

    0544bd37de62b386fa2ad5d3511e30b6c62c7f97

  • SHA256

    84f65ea0570ad0cb113671be14dfa4a7d0f04ebfa773d4f53103e401c39511d1

  • SHA512

    b80fa1c3f88795762e6957b9ad639fc60778f5f00dbf0d8b9d8f038abd6dd5f68a8f558fcc64cde27a286884390ee9c7676b2aa7fa6f9e6a2bcfd96607aec5fc

  • SSDEEP

    49152:3AA1/64VAI5jOkaEiJFc5+DOyUfnEza32ehyfTbBDm:3Aq/64VAI5ixEiJFbmIBa

Score
10/10
quasarcheatsspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Cheats

C2

anubisgod.duckdns.org:1338

Mutex

6f2a7175-754c-4ce5-a610-2f8866732c05

Attributes
  • encryption_key

    0411D8B9B23547F86733347B0634010F112E158F

  • install_name

    dlscord.exe

  • log_directory

    dlscordLogs

  • reconnect_delay

    3000

  • startup_key

    dlscord

  • subdirectory

    dlscord

Targets

    • Target

      tmp

    • Size

      2.8MB

    • MD5

      c41aa4383be3c790c15b89ac0b52a046

    • SHA1

      0544bd37de62b386fa2ad5d3511e30b6c62c7f97

    • SHA256

      84f65ea0570ad0cb113671be14dfa4a7d0f04ebfa773d4f53103e401c39511d1

    • SHA512

      b80fa1c3f88795762e6957b9ad639fc60778f5f00dbf0d8b9d8f038abd6dd5f68a8f558fcc64cde27a286884390ee9c7676b2aa7fa6f9e6a2bcfd96607aec5fc

    • SSDEEP

      49152:3AA1/64VAI5jOkaEiJFc5+DOyUfnEza32ehyfTbBDm:3Aq/64VAI5ixEiJFbmIBa

    Score
    10/10
    quasarcheatsspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks