Overview

overview

10

Static

static

1

b3c53eb585...a4.exe

windows7-x64

10

b3c53eb585...a4.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    b3c53eb5851703358e2bfacec3b19aa4.exe
  • Size 16KB
  • Sample240319-e9yt5shf82
  • SHA256 5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratquasarterrpersistenceratspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • TERR

C2

  • 77.232.132.25:4999

Mutex

  • 3cc5db7e-8210-40a3-9fe3-434d1f73d4d8

Attributes
  • encryption_key

    790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB

  • install_name

    LestaClient.exe

  • log_directory

    LestaLogs

  • reconnect_delay

    3000

  • startup_key

    Lesta Game Center

  • subdirectory

    Lesta

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • TERR

C2

  • 77.232.132.25:5001

Mutex

  • AsyncMutex_6SI8OJU81

Attributes
  • delay

    3

  • install

    false

  • install_file

    service.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      b3c53eb5851703358e2bfacec3b19aa4.exe
    • Size 16KB
    • SHA256 5a8e8e48add151c8058bad8173424e10e1a336dee8982da211d8f612323219c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncratquasarterrpersistenceratspywaretrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks