Overview

overview

10

Static

static

10

30eafdb7c2...73.exe

windows7-x64

10

30eafdb7c2...73.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6ddda01b781e92010749cae1248b6d51.bin

  • Size

    140KB

  • Sample

    231223-b77gqaeaam

  • MD5

    b6153857301a01d716d6ccc811305ae6

  • SHA1

    1f89d64c26609f18bef532f71bdddf8fb681639a

  • SHA256

    cb88e60dfc0edf87bfcc659724808f6b1b863bf902c97c6dadfb590b1495dacb

  • SHA512

    80a3c1c68de0a630cdfaaca6a757f18467e4532c35669c147e654ae83836b1d277aa6861bab5c50d01bd61aeded58e82e2ea916e16e0221c5797d07d97d623cf

  • SSDEEP

    3072:zWAet2EwfoJMXgyUVM3Ig8rJn0eUIxoq3Yo6hA/hrBvd:zWxtPjJMXgJ/g8l0eto0YoiAdBvd

Score
10/10
quasarspywaretrojan

Malware Config

Targets

    • Target

      30eafdb7c2c580890c4fb2a7101db1d22c88bd723603ff37ac4f13928dd84b73.exe

    • Size

      267KB

    • MD5

      6ddda01b781e92010749cae1248b6d51

    • SHA1

      f33280d5dee0bcd5b5f07c8d38e50b3833288192

    • SHA256

      30eafdb7c2c580890c4fb2a7101db1d22c88bd723603ff37ac4f13928dd84b73

    • SHA512

      c4d901e6a3846dd4995943ad38dbf8ea38669ed6936ca1d31354d9f330eb4f9b502e1c49b9b424184bdf8899a2ee4efe257dbc4bf0ff489c2be228f8a45301e2

    • SSDEEP

      6144:RaaXMzUmOZoqSYjO8KHGwgImxbEWMgdD:4achqSYFKHGw1m3Mw

    Score
    10/10
    quasarspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks