Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    344KB

  • Sample

    221123-qv9tmsfa32

  • MD5

    697898102d367f3a5fb7f790d199112e

  • SHA1

    ee94d4ade21d267503869c47a3b61ff30bb6305d

  • SHA256

    8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

  • SHA512

    752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

  • SSDEEP

    6144:7zkVzIZzF1Pq2o2zlOlqZ+Tz3RNGfbQpNsYsoSA7fiCEq/ab:Dh1P22zlkTNsY/iy/ab

Score
10/10
quasarofficeboxspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

OfficeBOX

C2

185.81.157.174:4554

Mutex

QSR_MUTEX_xSMql9r0AKSYarKyPE

Attributes
  • encryption_key

    RQ0DJiJOKJWym1FwBiYm

  • install_name

    Clientchrome.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    ChromeClient Startup

  • subdirectory

    SubDir

Targets

    • Target

      tmp

    • Size

      344KB

    • MD5

      697898102d367f3a5fb7f790d199112e

    • SHA1

      ee94d4ade21d267503869c47a3b61ff30bb6305d

    • SHA256

      8ad32ff282a91fd4dcc732cab9c853db3c0085dec8bbabb5388553938fd42f60

    • SHA512

      752fead6eff8116e5caf37d2c9af5f01bf756ec00e5bc98dabe72d552546e4537ef0d040c1f049e9707b536833abdd0b0f94ff4b4eb5cd2fa63cef22bb918b13

    • SSDEEP

      6144:7zkVzIZzF1Pq2o2zlOlqZ+Tz3RNGfbQpNsYsoSA7fiCEq/ab:Dh1P22zlkTNsY/iy/ab

    Score
    10/10
    quasarofficeboxspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks