General

  • Target

    b2e76e59cb192e6165ac25e33c5508f5126a6751436056dbbb5e0969abf4b8fc

  • Size

    3.1MB

  • Sample

    231119-wj4q5sbg9z

  • MD5

    848bf808ef1021c276136f3868f16f62

  • SHA1

    2471e8f93527bde575c1819069126733f49c7819

  • SHA256

    b2e76e59cb192e6165ac25e33c5508f5126a6751436056dbbb5e0969abf4b8fc

  • SHA512

    37c2ea62683b59cb72f5a696079a42212b7cda8775870c9f02681a8e7678e1a94f5d1fff0c88a5e5a8f2b6e0ad4f1d1387b0d203e4967cae36b9dda3ec524f5e

  • SSDEEP

    49152:WvmI22SsaNYfdPBldt698dBcjHv9ggmzA7oGduTHHB72eh2NT:Wvr22SsaNYfdPBldt6+dBcjHv9gi

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

riprealworld-55179.portmap.host:55179

Mutex

6a893031-8f7c-4e00-9e79-83e39719887d

Attributes
  • encryption_key

    3388F603979BF351F677D18F04E7A89AEBEE7BE8

  • install_name

    Windows.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows

  • subdirectory

    SubDir

Targets

    • Target

      b2e76e59cb192e6165ac25e33c5508f5126a6751436056dbbb5e0969abf4b8fc

    • Size

      3.1MB

    • MD5

      848bf808ef1021c276136f3868f16f62

    • SHA1

      2471e8f93527bde575c1819069126733f49c7819

    • SHA256

      b2e76e59cb192e6165ac25e33c5508f5126a6751436056dbbb5e0969abf4b8fc

    • SHA512

      37c2ea62683b59cb72f5a696079a42212b7cda8775870c9f02681a8e7678e1a94f5d1fff0c88a5e5a8f2b6e0ad4f1d1387b0d203e4967cae36b9dda3ec524f5e

    • SSDEEP

      49152:WvmI22SsaNYfdPBldt698dBcjHv9ggmzA7oGduTHHB72eh2NT:Wvr22SsaNYfdPBldt6+dBcjHv9gi

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks