Overview

overview

10

Static

static

1

Putin HVNC.exe

windows7-x64

10

Putin HVNC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PutinHVNC.zip

  • Size

    6.0MB

  • Sample

    230407-qryl7sbb5v

  • MD5

    b467372ae11ed7912e35a225012e69ea

  • SHA1

    4cc76333f61b17c0d1d72be3122f4e5ab473d3c6

  • SHA256

    228d69b584a30850150d764957b76a2bce941d8821ef898254a0887bf22a9f46

  • SHA512

    6e5b70c1eb03af267ff998e5f10da3114709ad22336991bbbab96dd57acf668b0db197c12b83f3bf675c06a20798d019e6c7d426c17a4aa7fb058e4895e0533b

  • SSDEEP

    98304:PNRMdSGqsj1QAAdrFf3sDsJT9Se+dBhqu59DqUeAyNyLQ8IkQEfBSvXKs0X:c5qe1QpphTMe+d/qkdeAyAL5IkHUvXO

Score
10/10
quasaroffice04agilenetspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

78.140.241.23:4444

Mutex

b6ff6b7f-6e01-4ada-8e62-225309051aaa

Attributes
  • encryption_key

    8A56B194BACB885BA2FB683EC1F8E992BCE87CB4

  • install_name

    scupdate.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    Windows System

Targets

    • Target

      Putin HVNC.exe

    • Size

      6.2MB

    • MD5

      d02b031b2304b254b88bd2b7ba91dbaf

    • SHA1

      b0f290256f24a2605b228ddd7d61cd5ea58ef00a

    • SHA256

      6745e6d06f72da9f03aa75a67e462a3dfb3d04b6dfdc41dd4b1d85e76686ce75

    • SHA512

      cf9ca851432640e26dcdc1a6511599f93b6ca25324290f1728458fc9482da6998a9afdbe517b68ecf0428683b51babed7714566753567f83a8206c1662d60e60

    • SSDEEP

      196608:sB+OhopE3jXIpi1DUbVwoDMp4IHkXBNB9B:UopE3TII5EVwSnLxVB

    Score
    10/10
    quasaroffice04agilenetspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks