Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    405KB

  • Sample

    230604-qsjvfach8t

  • MD5

    5d28f72d1aad116bab07c41530e7734a

  • SHA1

    1b0a277f8bbb8dbee1e791cda8c134d138ce0c38

  • SHA256

    d1051935a532ce6813099c06cc359aa1e02cb1f0e341583b3ec3253186e33a80

  • SHA512

    39b9acaa7fbc7c6d1393d734cfec2fb3bda58abecaaed5b4c8d51cefc46e353fbbf5520ce6acb9ef2464ec1c529cc8ee4bad7b05a224caad1b1854087d2f807b

  • SSDEEP

    6144:R+iBrrx0Bua4fRbLHp6t/ixYbaZZWstTC/2pQLrUwlYh:FBrP0hiHHtO/GWrUwlYh

Score
10/10
quasarnamesystemspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

NameSystem

C2

bobbawb1000.duckdns.org:23092

Mutex

32m2kfpPHGN1CMuUm

Attributes
  • encryption_key

    bhThH4m2frhSbvbgSILD

  • install_name

    dirsys.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    dirsys

  • subdirectory

    DirSys

Targets

    • Target

      Client-built.exe

    • Size

      405KB

    • MD5

      5d28f72d1aad116bab07c41530e7734a

    • SHA1

      1b0a277f8bbb8dbee1e791cda8c134d138ce0c38

    • SHA256

      d1051935a532ce6813099c06cc359aa1e02cb1f0e341583b3ec3253186e33a80

    • SHA512

      39b9acaa7fbc7c6d1393d734cfec2fb3bda58abecaaed5b4c8d51cefc46e353fbbf5520ce6acb9ef2464ec1c529cc8ee4bad7b05a224caad1b1854087d2f807b

    • SSDEEP

      6144:R+iBrrx0Bua4fRbLHp6t/ixYbaZZWstTC/2pQLrUwlYh:FBrP0hiHHtO/GWrUwlYh

    Score
    10/10
    quasarnamesystemspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks