General

  • Target

    NEAS.802e9bbcb33d5b3f222699ac303878f0.exe

  • Size

    3.1MB

  • Sample

    231117-x95xkaed3s

  • MD5

    802e9bbcb33d5b3f222699ac303878f0

  • SHA1

    18f3085ab820600a9760aeb35cc769f8e36651d7

  • SHA256

    ac285b44114bc26c6157453b4de8331c816c6e63cd2c9db6c3f7d0542b203b6c

  • SHA512

    9a1ae390c9c36574057f0013d4adaf29c2b2df628bb19c140589f90cbe3581493675e32bf57780d1b2365ba32677b13a5b2950fd2a194ce43493e46d36fb46da

  • SSDEEP

    49152:HvjI22SsaNYfdPBldt698dBcjHtd7k9hwvJNLoGdLoXTHHB72eh2NT:Hvc22SsaNYfdPBldt6+dBcjHwhkM

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.31.230:5222

Mutex

24909cc9-d0ac-4b43-bf14-6f63221c1d51

Attributes
  • encryption_key

    32C3DF0A26774C6C09E708CD50341508C4CC1273

  • install_name

    minecraft free.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Discord Updater

  • subdirectory

    SubDir

Targets

    • Target

      NEAS.802e9bbcb33d5b3f222699ac303878f0.exe

    • Size

      3.1MB

    • MD5

      802e9bbcb33d5b3f222699ac303878f0

    • SHA1

      18f3085ab820600a9760aeb35cc769f8e36651d7

    • SHA256

      ac285b44114bc26c6157453b4de8331c816c6e63cd2c9db6c3f7d0542b203b6c

    • SHA512

      9a1ae390c9c36574057f0013d4adaf29c2b2df628bb19c140589f90cbe3581493675e32bf57780d1b2365ba32677b13a5b2950fd2a194ce43493e46d36fb46da

    • SSDEEP

      49152:HvjI22SsaNYfdPBldt698dBcjHtd7k9hwvJNLoGdLoXTHHB72eh2NT:Hvc22SsaNYfdPBldt6+dBcjHwhkM

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks