Overview

overview

10

Static

static

10

Image Logger.exe

windows10-2004-x64

10

Image Logger.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Image Logger.exe

  • Size

    3.1MB

  • Sample

    240101-q2dd1sbhdk

  • MD5

    6af433dc5c20b6c59cb8c2b63ddf4963

  • SHA1

    e378ad8a93a6859afb38f10332a044b1b898baca

  • SHA256

    cbe49c46c68fbf9a6733b839945e3eb01c02ee26e7a327ebb54aacad4e765a2b

  • SHA512

    4ba72e6858d3aecc2f87d0b23516ae7915df49fcbb91747c5d24462750e867956b1bb72e5fda397c8eb7a95d67440125de01167f78d79bc946b1397ec35e0de0

  • SSDEEP

    49152:bvrI22SsaNYfdPBldt698dBcjHRMxNESExk/iHLoGdhYTHHB72eh2NT:bvU22SsaNYfdPBldt6+dBcjHWxwrR

Score
10/10
quasarimage loggerspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Image Logger

C2

promptylol-31420.portmap.io:5950

Mutex

4cdcc137-c98a-4223-9eca-fa3c3f414513

Attributes
  • encryption_key

    92AAA484892AFDE2F29DD42856FA1D969FC2CCFE

  • install_name

    sys.exe

  • log_directory

    Logs

  • reconnect_delay

    2995

  • startup_key

    bootmgr

  • subdirectory

    critical

Targets

    • Target

      Image Logger.exe

    • Size

      3.1MB

    • MD5

      6af433dc5c20b6c59cb8c2b63ddf4963

    • SHA1

      e378ad8a93a6859afb38f10332a044b1b898baca

    • SHA256

      cbe49c46c68fbf9a6733b839945e3eb01c02ee26e7a327ebb54aacad4e765a2b

    • SHA512

      4ba72e6858d3aecc2f87d0b23516ae7915df49fcbb91747c5d24462750e867956b1bb72e5fda397c8eb7a95d67440125de01167f78d79bc946b1397ec35e0de0

    • SSDEEP

      49152:bvrI22SsaNYfdPBldt698dBcjHRMxNESExk/iHLoGdhYTHHB72eh2NT:bvU22SsaNYfdPBldt6+dBcjHWxwrR

    Score
    10/10
    quasarimage loggerspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks