Resubmissions

22/01/2024, 21:07

240122-zydp2sdhd810

22/01/2024, 19:29

240122-x7dejadbb710

General

  • Target
    Craft_Rise_Hack_Cheat_V1.17.23.rar
  • Size 1.6MB
  • Sample240122-x7dejadbb7
  • SHA256 5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.1

Botnet
  • Office04

C2
  • 139.180.171.110:22766

Mutex
  • 559c79bc-4c64-4106-a5ab-e40703620b71

Attributes
  • encryption_key

    9C52BAC3CB66706D47E06069A5809DE8E12F205F

  • install_name

    System32.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    System32

  • subdirectory

    SubDir

Targets

    • Target
      Craft_Rise_Hack_Cheat_V1.17.23.rar
    • Size 1.6MB
    • SHA256 5b3dc5017ab4178e6a056c61ef8e205982bcfa7b7fd8854b82fd4e9aa9d0274d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Target
      Craft_Rise_Hack_Cheat_V1.17.23/Craft_Rise_Cheacker.exe
    • Size 1.5MB
    • SHA256 def9ca51ee50b3e34df194b618b5db125712facd64dc4f9ab52d4044348ce36e
    • MD5 SHA1 SHA512 SSDEEP
    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Target
      Craft_Rise_Hack_Cheat_V1.17.23/Craft_Rise_Hack_Cheat_V1.17.23.exe
    • Size 146KB
    • SHA256 5fd835db939307a0c43d18c702804d50c3ea5ea124f1e714edb82fa6ccaba214
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Craft_Rise_Hack_Cheat_V1.17.23/Valo_Cheat_V1.89.413.dll
    • Size 10KB
    • SHA256 eb33cace01b6bb8503f06a83279e6d231bbc4cb0751838758fa4dfe379105c31
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Enterprise v15

Tasks