Overview

overview

10

Static

static

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built 2.rar

  • Size

    321KB

  • Sample

    221219-d2qccshb4z

  • MD5

    58600eb9036d15da41320e832d4bcf93

  • SHA1

    4278848821e4191e1ae22f7c53421ad59b9cb188

  • SHA256

    0519a93b01b9929423e8313cc6f425f596d19ace6e81d0d3d3749703fc236188

  • SHA512

    079937b138c70b82b0931af584eb8287be76c0c711b4631598fc2e4cb28548f3d2f7e2dd88ae873972bb1b522c914b4b50f9123bff65da7d5b681c92c8f5830f

  • SSDEEP

    6144:BEG6xo6hBpdKj0bFmySPhm/EXsoPUsU/eWmwqejeEnMsfRGIZ77MjJSzH:GHBDw0bFmbA00C9Entd84H

Score
10/10
quasarpersistencespywaretrojan

Malware Config

Targets

    • Target

      Client-built.exe

    • Size

      342KB

    • MD5

      0b0287fdaa9bea5c3289fee8e4677e46

    • SHA1

      5f2dcbfd4348c88f772d8b50746f7ba989aade90

    • SHA256

      5b045134161e8922ea16d3aae401edbe088113690fa7aacacb274481150f8872

    • SHA512

      420cfb68b777c0acb94566e9adb04b0fb89ff41d0f517cb51d8a3e3de7c03c38a48662c964ab92c0a0e082fe39a636ac69bbe0c4144ef2bafc329a7c5bea7592

    • SSDEEP

      6144:f0N453rTzUAGKXIl3q09GeRpeP6aqSAXAkacT73/GVzebSfMgMtRz:f0N41zUiIl3f9GeRq6aqSAXAkp73Szm3

    Score
    10/10
    quasarpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks