Overview

overview

10

Static

static

1

nudess.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    nudess.exe

  • Size

    343KB

  • Sample

    230304-y4rcnaeg74

  • MD5

    bfc1baa2c6212a9db28aafc3b72849dc

  • SHA1

    f80cf447e4e03c35d38c1206c7d29e4298e69b61

  • SHA256

    0c261eb4e9a6f5b98148c69192deb3e342b7f99c08422dd9c86c5fbf6faded1e

  • SHA512

    804d74f61ab77744e5e54d92c393aa2e1f52f0f2df230424cffee412a079e079dbc77619ccb430d2bb500da3827ea1e802ee421bd98c2761aa33fe7e87013933

  • SSDEEP

    6144:e05VULOjhrJ3v/gGr5eaOpw08gvY4zbFSBhy7aQqAd/BbQsXoCbosz:e0XULOxlTrkjpw9gvbS3WHtBbxNz

Score
10/10
quasarpersistencespywaretrojan

Malware Config

Targets

    • Target

      nudess.exe

    • Size

      343KB

    • MD5

      bfc1baa2c6212a9db28aafc3b72849dc

    • SHA1

      f80cf447e4e03c35d38c1206c7d29e4298e69b61

    • SHA256

      0c261eb4e9a6f5b98148c69192deb3e342b7f99c08422dd9c86c5fbf6faded1e

    • SHA512

      804d74f61ab77744e5e54d92c393aa2e1f52f0f2df230424cffee412a079e079dbc77619ccb430d2bb500da3827ea1e802ee421bd98c2761aa33fe7e87013933

    • SSDEEP

      6144:e05VULOjhrJ3v/gGr5eaOpw08gvY4zbFSBhy7aQqAd/BbQsXoCbosz:e0XULOxlTrkjpw9gvbS3WHtBbxNz

    Score
    10/10
    quasarpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks