Overview

overview

10

Static

static

10

msedge.exe

windows7-x64

10

msedge.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    msedge.exe

  • Size

    3.1MB

  • Sample

    230806-gssb5sgb67

  • MD5

    601b5ceb9825f198f947dd3f6ff3426c

  • SHA1

    194d19c1cd161685cefd979234206af5e5fa619b

  • SHA256

    964075417678392171f77862b062dc35ebd24bdbc3826e02c5bd00e0e7cd4651

  • SHA512

    ed1ab84dbd876154d031d0f04e06771c9e082c5756fa796b745e488d3e48a61a569f907123dcb9dd036397f0b956a61dc87b6cb7ffeb49bdc53e9583471dfff2

  • SSDEEP

    49152:nvUt62XlaSFNWPjljiFa2RoUYIaIRJ6FbR3LoGdUrTHHB72eh2NT:nvI62XlaSFNWPjljiFXRoUYIaIRJ6XE

Score
10/10
quasarsystemspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

system

C2

185.183.35.122:4782

Mutex

033db415-964b-488b-a1d8-81ebb438757c

Attributes
  • encryption_key

    CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896

  • install_name

    conhost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Defender

  • subdirectory

    SubDir

Targets

    • Target

      msedge.exe

    • Size

      3.1MB

    • MD5

      601b5ceb9825f198f947dd3f6ff3426c

    • SHA1

      194d19c1cd161685cefd979234206af5e5fa619b

    • SHA256

      964075417678392171f77862b062dc35ebd24bdbc3826e02c5bd00e0e7cd4651

    • SHA512

      ed1ab84dbd876154d031d0f04e06771c9e082c5756fa796b745e488d3e48a61a569f907123dcb9dd036397f0b956a61dc87b6cb7ffeb49bdc53e9583471dfff2

    • SSDEEP

      49152:nvUt62XlaSFNWPjljiFa2RoUYIaIRJ6FbR3LoGdUrTHHB72eh2NT:nvI62XlaSFNWPjljiFXRoUYIaIRJ6XE

    Score
    10/10
    quasarsystemspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks