General

  • Target

    03b3994449556eb9937fb8baa0ffbffa

  • Size

    407KB

  • Sample

    231229-zn91habfe9

  • MD5

    03b3994449556eb9937fb8baa0ffbffa

  • SHA1

    e08d0eaf2ffec67b73b2771ac82fa6ee07c2f6ae

  • SHA256

    3e66131bb29804bf3fd4a1550c916a767d35729f73ba0cd77b904872c9bebe95

  • SHA512

    516840a95304dc4b77dcf519f299b5960958b1497917d8e065a5fe373ff5b31611938b9906003216eee8b8a4348fa12e2688c6662cabd67b246d60e811560664

  • SSDEEP

    6144:0TEgdc0YNX7IxUpGREWUA47qbOkQgaezUUNxnsbC733OcTR3k:0TEgdfYWxUj5wjz3nRucdk

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

forthacks.hopto.org:4782

Mutex

1abe5811-fa99-4884-a104-b9abb6bc0fc6

Attributes
  • encryption_key

    FF1B2D5C6F8DB53C50B257D39B9CB924BE482CB1

  • install_name

    directx.exe

  • log_directory

    updatelog

  • reconnect_delay

    3000

  • startup_key

    Steam

  • subdirectory

    directx

Targets

    • Target

      03b3994449556eb9937fb8baa0ffbffa

    • Size

      407KB

    • MD5

      03b3994449556eb9937fb8baa0ffbffa

    • SHA1

      e08d0eaf2ffec67b73b2771ac82fa6ee07c2f6ae

    • SHA256

      3e66131bb29804bf3fd4a1550c916a767d35729f73ba0cd77b904872c9bebe95

    • SHA512

      516840a95304dc4b77dcf519f299b5960958b1497917d8e065a5fe373ff5b31611938b9906003216eee8b8a4348fa12e2688c6662cabd67b246d60e811560664

    • SSDEEP

      6144:0TEgdc0YNX7IxUpGREWUA47qbOkQgaezUUNxnsbC733OcTR3k:0TEgdfYWxUj5wjz3nRucdk

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks