Overview

overview

10

Static

static

10

bcf82013e3...98.exe

windows7-x64

10

bcf82013e3...98.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    bcf82013e39cef4310eb312625ab8598
  • Size 157KB
  • Sample240309-2elbwscf49
  • SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasarrevengeratgamespersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.0.0

Botnet

  • Games

C2

  • services18.dns.army:7000

  • ss1999.64-b.it:7000

Mutex

  • 5EwVZpKkbJ5fq0j9og

Attributes
  • encryption_key

    O6mxl5VNcg9uGSOey4nY

  • install_name

    Instalation Rep.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Firefox Update

  • subdirectory

    Instalation

Targets

    • Target
      bcf82013e39cef4310eb312625ab8598
    • Size 157KB
    • SHA256 088023dee5807788786ad2707fa34ae3422654ecb0cb9efbc1eb268cec958ff0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasarrevengeratgamesspywaretrojanpersistence

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks