General

  • Target

    gizmo.bat

  • Size

    13KB

  • Sample

    240212-cvgwzagc8v

  • MD5

    4f5e2a45a205c03f35cfc258a6fa78c4

  • SHA1

    409cc00e8a84f9feebaaeca597df0e7840433ea7

  • SHA256

    a74b4c512087be32af7863d596f2946ba0e160b863aa3ba2380b85cf6b607a14

  • SHA512

    cc769438aea44a2197708631e5a72f4fdbd6c1ddf0716f98c2eb297cfacfb10c6a3d8dd6f42f6270f47be36b2055ff4cf174c5e131b9fd7ee785bf7f1503a32a

  • SSDEEP

    384:uYfiuv5LxLQ8lWxuzgUKEs7huHSH2vUV2EUbPxCJ0VbHAPVg//9hRaYc5Sjm5FFi:uY6uv5LxLQ8lWxuzgUKEs7huHSH2vUV2

Score
10/10

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Targets

    • Target

      gizmo.bat

    • Size

      13KB

    • MD5

      4f5e2a45a205c03f35cfc258a6fa78c4

    • SHA1

      409cc00e8a84f9feebaaeca597df0e7840433ea7

    • SHA256

      a74b4c512087be32af7863d596f2946ba0e160b863aa3ba2380b85cf6b607a14

    • SHA512

      cc769438aea44a2197708631e5a72f4fdbd6c1ddf0716f98c2eb297cfacfb10c6a3d8dd6f42f6270f47be36b2055ff4cf174c5e131b9fd7ee785bf7f1503a32a

    • SSDEEP

      384:uYfiuv5LxLQ8lWxuzgUKEs7huHSH2vUV2EUbPxCJ0VbHAPVg//9hRaYc5Sjm5FFi:uY6uv5LxLQ8lWxuzgUKEs7huHSH2vUV2

    Score
    10/10
    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks