General

  • Target

    08429299.exe

  • Size

    3.1MB

  • Sample

    230601-seh24aeh58

  • MD5

    4bfcf945a94b7497d44dec0e663e2903

  • SHA1

    1456b93f6ef6225a635955662641524e95e4f5ce

  • SHA256

    e5556b22dcd6d7d26ce0e58e050632a0a03bf9fa2515953aaca8473e5f959f1d

  • SHA512

    2ff0b5dab62e771429e44a3b1245d6839487b13a560075f054c5795cc1c89cd0f3a2b4eb3a951c1483f88fc2dae33a5bac0f4b60d93c5c1acc50c177f4311a3c

  • SSDEEP

    49152:EvblL26AaNeWgPhlmVqvMQ7XSKVDxNESE6k/iNLoGd+8THHB72eh2NT:EvBL26AaNeWgPhlmVqkQ7XSKVxFF

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Telegram Users

C2

xegefi6666-30878.portmap.host:30878

Mutex

fa554b4d-a1d6-4917-9f68-8f040924e03d

Attributes
  • encryption_key

    B736867CD516C8B6FB67365ADF945A5FC6943067

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Defender

  • subdirectory

    SubDir

Targets

    • Target

      08429299.exe

    • Size

      3.1MB

    • MD5

      4bfcf945a94b7497d44dec0e663e2903

    • SHA1

      1456b93f6ef6225a635955662641524e95e4f5ce

    • SHA256

      e5556b22dcd6d7d26ce0e58e050632a0a03bf9fa2515953aaca8473e5f959f1d

    • SHA512

      2ff0b5dab62e771429e44a3b1245d6839487b13a560075f054c5795cc1c89cd0f3a2b4eb3a951c1483f88fc2dae33a5bac0f4b60d93c5c1acc50c177f4311a3c

    • SSDEEP

      49152:EvblL26AaNeWgPhlmVqvMQ7XSKVDxNESE6k/iNLoGd+8THHB72eh2NT:EvBL26AaNeWgPhlmVqkQ7XSKVxFF

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Tasks