Overview

overview

10

Static

static

10

Setup NanoCore.exe

windows7-x64

10

Setup NanoCore.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Setup NanoCore.exe

  • Size

    502KB

  • Sample

    230101-gsljlaed9s

  • MD5

    2432a79f87ae0700a2f681bb4c80fc7d

  • SHA1

    7305644f24889c2d1184b1917427ef73b25b3c9d

  • SHA256

    462f9fb435ede4892a1b4ffaadcb747825d2c361f6b153beee552ec295c48dc0

  • SHA512

    ee265f09302b8ed65a1133dcedea0619c2f54544760e4f819da91528487c9870aa659dfc9ac731536ea0d70401188d1afb966b30505f77d58d71fdceb86e3c72

  • SSDEEP

    6144:oTEgdc0YZXbZvdo6EsRwdCO+ZSOD/A6uscEwqb8F9WQLSqYYcTR32:oTEgdfYvdo6VZksgN7S1Ycd2

Score
10/10
quasaroffice01spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office01

C2

192.168.126.1:4782

5.165.98.151:4782
Mutex

a85aa22e-e90d-4495-8562-3795974d8493

Attributes
  • encryption_key

    11F19CA636E6BC02F3A0417454F784805D789D97

  • install_name

    NanoCore.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Startup

  • subdirectory

    AntiMalware Service Рфслув

Targets

    • Target

      Setup NanoCore.exe

    • Size

      502KB

    • MD5

      2432a79f87ae0700a2f681bb4c80fc7d

    • SHA1

      7305644f24889c2d1184b1917427ef73b25b3c9d

    • SHA256

      462f9fb435ede4892a1b4ffaadcb747825d2c361f6b153beee552ec295c48dc0

    • SHA512

      ee265f09302b8ed65a1133dcedea0619c2f54544760e4f819da91528487c9870aa659dfc9ac731536ea0d70401188d1afb966b30505f77d58d71fdceb86e3c72

    • SSDEEP

      6144:oTEgdc0YZXbZvdo6EsRwdCO+ZSOD/A6uscEwqb8F9WQLSqYYcTR32:oTEgdfYvdo6VZksgN7S1Ycd2

    Score
    10/10
    quasaroffice01spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks