Overview

overview

10

Static

static

10

a.exe

windows7-x64

10

a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a.exe

  • Size

    3.1MB

  • Sample

    230930-x55q1afa4y

  • MD5

    cc3ea796575dfcf9944dc2b100b88030

  • SHA1

    1af5febda7a5380c9be9b56d9552b38427a1b3a4

  • SHA256

    ea38cf7b0c86d4ac03a1f48d1675c0ee227dcbed89d073b3a67f65774c7f956d

  • SHA512

    3c97296a50022b5d8ff7ab1811521d1da02a47691197ea1fb3a61160c02f19658f051216bcd81bbaf6e4929a9643e96451febdcc34e4d4c85430fb3572f964aa

  • SSDEEP

    49152:uv0t62XlaSFNWPjljiFa2RoUYIFxPEak5k/LCtoGdNTHHB72eh2NT:uvo62XlaSFNWPjljiFXRoUYIFxbo

Score
10/10
quasar1stspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

1st

C2

172.234.16.71:4444

Mutex

0af47b97-43c7-4ab0-95a1-8d9a9a8f797f

Attributes
  • encryption_key

    B60DF71C950D2BE72D00A583D2E2E6202680FD45

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    10

  • startup_key

    gg

  • subdirectory

    SubDir

Targets

    • Target

      a.exe

    • Size

      3.1MB

    • MD5

      cc3ea796575dfcf9944dc2b100b88030

    • SHA1

      1af5febda7a5380c9be9b56d9552b38427a1b3a4

    • SHA256

      ea38cf7b0c86d4ac03a1f48d1675c0ee227dcbed89d073b3a67f65774c7f956d

    • SHA512

      3c97296a50022b5d8ff7ab1811521d1da02a47691197ea1fb3a61160c02f19658f051216bcd81bbaf6e4929a9643e96451febdcc34e4d4c85430fb3572f964aa

    • SSDEEP

      49152:uv0t62XlaSFNWPjljiFa2RoUYIFxPEak5k/LCtoGdNTHHB72eh2NT:uvo62XlaSFNWPjljiFXRoUYIFxbo

    Score
    10/10
    quasar1stspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks