quasar | fc0157002df8601352c8f805bcee6b2db4d43937334ce95565bba2d8fa6f6b00 | Triage

Sharing

General

Target

2148-11-0x0000000000400000-0x0000000000724000-memory.dmp
Size

3.1MB
Sample

231231-3xwe9agccn
MD5

d88f88e3a0a447801673ac8c9c24637c
SHA1

ed4b7c72ea64fb4d780be0f218be2b6c206f27a8
SHA256

fc0157002df8601352c8f805bcee6b2db4d43937334ce95565bba2d8fa6f6b00
SHA512

8098326ec718fa77ace190a705222db921b06b04e81b1cd557eb3013cb81b0a72fb3834e95375a9806854ee33fe55c74c02fc235a98ff685c62d80f5be22a37d
SSDEEP

49152:uvKY52fyaSZOrPWluWBuGG5g5h/0Ha95bQDk/mLoGdzSTHHB72eh2NT:uv/52fyaSZOrPWluWBDG5g5hEaM

Score

10^/10

quasar update

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

update

C2

127.0.0.1:4782

Mutex

ddb0d81d-667e-44c3-a1b7-00fcb82dd1ef

Attributes

encryption_key
00DF680B0E09235E9256570DFF972BC701444E37
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
putty
subdirectory
SubDir

Targets

- Target
  
  2148-11-0x0000000000400000-0x0000000000724000-memory.dmp
- Size
  
  3.1MB
- MD5
  
  d88f88e3a0a447801673ac8c9c24637c
- SHA1
  
  ed4b7c72ea64fb4d780be0f218be2b6c206f27a8
- SHA256
  
  fc0157002df8601352c8f805bcee6b2db4d43937334ce95565bba2d8fa6f6b00
- SHA512
  
  8098326ec718fa77ace190a705222db921b06b04e81b1cd557eb3013cb81b0a72fb3834e95375a9806854ee33fe55c74c02fc235a98ff685c62d80f5be22a37d
- SSDEEP
  
  49152:uvKY52fyaSZOrPWluWBuGG5g5h/0Ha95bQDk/mLoGdzSTHHB72eh2NT:uv/52fyaSZOrPWluWBDG5g5hEaM
Score

1^/10
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2