General
-
Target
beeb985707b6f8539ad51664530bfb507ca9f65d9c1e6e716ca95f5d7e13291bexe_JC.exe
-
Size
1.4MB
-
Sample
230811-rejsysfc5v
-
MD5
4f6212f670b6bc2372a97d6ecb2bfbeb
-
SHA1
789b0d58500c5ca8d53df74edfadcf42f2e0c814
-
SHA256
beeb985707b6f8539ad51664530bfb507ca9f65d9c1e6e716ca95f5d7e13291b
-
SHA512
943e92afe2b3aab6929ad8c2b9334155cfca6d0fe954d13e183b975a5598fc6373f4690843ab6cece9a0c1cf42e0157b3c153c8a9297661d9fd7aa6b10a6b699
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
Static task
static1
Behavioral task
behavioral1
Sample
beeb985707b6f8539ad51664530bfb507ca9f65d9c1e6e716ca95f5d7e13291bexe_JC.exe
Resource
win7-20230712-en
Malware Config
Extracted
quasar
1.3.0.0
-
94.131.105.161:12344
QSR_MUTEX_UEgITWnMKnRP3EZFzK
-
encryption_key
5Q0JQBQQfAUHRJTcAIOF
-
install_name
lient.exe
-
log_directory
Lugs
-
reconnect_delay
3000
-
startup_key
itartup
-
subdirectory
SubDir
Targets
-
-
Target
beeb985707b6f8539ad51664530bfb507ca9f65d9c1e6e716ca95f5d7e13291bexe_JC.exe
-
Size
1.4MB
-
MD5
4f6212f670b6bc2372a97d6ecb2bfbeb
-
SHA1
789b0d58500c5ca8d53df74edfadcf42f2e0c814
-
SHA256
beeb985707b6f8539ad51664530bfb507ca9f65d9c1e6e716ca95f5d7e13291b
-
SHA512
943e92afe2b3aab6929ad8c2b9334155cfca6d0fe954d13e183b975a5598fc6373f4690843ab6cece9a0c1cf42e0157b3c153c8a9297661d9fd7aa6b10a6b699
-
SSDEEP
24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk
-
Quasar payload
-
Modifies Windows Firewall
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1