Overview

overview

10

Static

static

1

68f2127ca5...6f.chm

windows7-x64

1

68f2127ca5...6f.chm

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    68f2127ca5e808474139b66d145a3cc539c81b98d199e66e40e2d8ebc539fb6f.chm

  • Size

    11KB

  • Sample

    230710-hj3xyshh6s

  • MD5

    cbf4a64e3ac80ffc592c0a5a109d6cb2

  • SHA1

    63d3ce3fe2e5a54a37bbb5059ec9884212ca6240

  • SHA256

    68f2127ca5e808474139b66d145a3cc539c81b98d199e66e40e2d8ebc539fb6f

  • SHA512

    cce778149ac0d86e681f1f3e2912d668aebc74a02df82a5eb1f968c23a69a9aebc1cea243ae50d89898604a17542688b34822a9fa0d9a0885869cad8a53ac383

  • SSDEEP

    96:Mg14WHmLKd7Kw7GK6Q46bvuY3VKdmq83hWw3IOqdEy:MgPGLSKc6lsxVKdp83hWw3c

Score
10/10
quasarspywaretrojan

Malware Config

Targets

    • Target

      68f2127ca5e808474139b66d145a3cc539c81b98d199e66e40e2d8ebc539fb6f.chm

    • Size

      11KB

    • MD5

      cbf4a64e3ac80ffc592c0a5a109d6cb2

    • SHA1

      63d3ce3fe2e5a54a37bbb5059ec9884212ca6240

    • SHA256

      68f2127ca5e808474139b66d145a3cc539c81b98d199e66e40e2d8ebc539fb6f

    • SHA512

      cce778149ac0d86e681f1f3e2912d668aebc74a02df82a5eb1f968c23a69a9aebc1cea243ae50d89898604a17542688b34822a9fa0d9a0885869cad8a53ac383

    • SSDEEP

      96:Mg14WHmLKd7Kw7GK6Q46bvuY3VKdmq83hWw3IOqdEy:MgPGLSKc6lsxVKdp83hWw3c

    Score
    10/10
    quasarspywaretrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks