General

  • Target

    Client-built.exe

  • Size

    3MB

  • Sample

    230528-tem7gsfh8w

  • MD5

    7df4e544bf7658d90be86b4719b32bf1

  • SHA1

    0fe125b130f8cd829e91c4405a1c20171f7b9e6d

  • SHA256

    837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

  • SHA512

    bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

  • SSDEEP

    49152:rvvI22SsaNYfdPBldt698dBcjHFI6OBxfRoGdzhTHHB72eh2NT:rvg22SsaNYfdPBldt6+dBcjHa64

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

57.5034.214.1:4782

Mutex

7cfe7fd0-8b48-41d0-86ed-0f1f7bc93aa7

Attributes
  • encryption_key

    8DC329A0B0D672D54EA380BA2B8C673FA58CCC1A

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3MB

    • MD5

      7df4e544bf7658d90be86b4719b32bf1

    • SHA1

      0fe125b130f8cd829e91c4405a1c20171f7b9e6d

    • SHA256

      837407f9ad35492f9ee8ed7fdcecdd82fd715d3d60c5cc531d6a9dc43dc21cf4

    • SHA512

      bc95431e5d58bcf583f7fd3baf2af83bd638b4cec23c3e617b0cdbb111da3fae7e65872e2b48ac4638d9776fd496ede7a6f06da0ebd380c88516e5ae32fbe346

    • SSDEEP

      49152:rvvI22SsaNYfdPBldt698dBcjHFI6OBxfRoGdzhTHHB72eh2NT:rvg22SsaNYfdPBldt6+dBcjHa64

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Bootkit

1
T1067

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Command and Control

Web Service

1
T1102

Tasks