Overview

overview

10

Static

static

10

1914a2c8d1...37.exe

windows7-x64

10

1914a2c8d1...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1914a2c8d1589d346dec86208bbbee37

  • Size

    502KB

  • Sample

    231230-p3qv3aeaf4

  • MD5

    1914a2c8d1589d346dec86208bbbee37

  • SHA1

    c9f854cb866fc0dfa54ad4438fb1e3479a9a384e

  • SHA256

    a725bb8800499239e18eb3973b4c4371214e8da4efb12108ac42957a3819572b

  • SHA512

    fb7c411b9aa69deb8ac2660846a555e3bc2481dea13b858f1aa214a67160f02eb205dd08e84c6867c06deddca00ca562c938e2f667e05faac67adfcd9385799c

  • SSDEEP

    6144:RTEgdc0Y3XAGbgiIN2RSBytYsf4q2gRslboscE6Ob8F9SAO+uKaE6lcTR3S:RTEgdfYvbgeeAb5sqpAx+uKadlcdS

Score
10/10
quasartest1spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

test1

C2

166.62.33.218:6624

Mutex

b2e23ea3-acf2-4226-ae2a-ae57e85e6e82

Attributes
  • encryption_key

    C8BFD012DB4B42D492F03E53D34F6E70BFC0E813

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      1914a2c8d1589d346dec86208bbbee37

    • Size

      502KB

    • MD5

      1914a2c8d1589d346dec86208bbbee37

    • SHA1

      c9f854cb866fc0dfa54ad4438fb1e3479a9a384e

    • SHA256

      a725bb8800499239e18eb3973b4c4371214e8da4efb12108ac42957a3819572b

    • SHA512

      fb7c411b9aa69deb8ac2660846a555e3bc2481dea13b858f1aa214a67160f02eb205dd08e84c6867c06deddca00ca562c938e2f667e05faac67adfcd9385799c

    • SSDEEP

      6144:RTEgdc0Y3XAGbgiIN2RSBytYsf4q2gRslboscE6Ob8F9SAO+uKaE6lcTR3S:RTEgdfYvbgeeAb5sqpAx+uKadlcdS

    Score
    10/10
    quasartest1spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks