Overview

overview

10

Static

static

10

yourcute.exe

windows7-x64

10

yourcute.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yourcute.exe

  • Size

    3.1MB

  • Sample

    240324-zy1vksbd4t

  • MD5

    561d2b135a6200ef094b222eb47af87a

  • SHA1

    4db2f2254cae3695a0ffa7ccdc13097db254cd8c

  • SHA256

    c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

  • SHA512

    6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094

  • SSDEEP

    49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv

Score
10/10
quasarslavespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:36039

Mutex

df49f69a-66a2-4b6e-bb60-18c12b5b14df

Attributes
  • encryption_key

    6A1671418BB270D703D501AB8E9B41E8D413B6D3

  • install_name

    Client.exe

  • log_directory

    Win64ErrorLogs

  • reconnect_delay

    3000

  • startup_key

    Windows Boot Menu

  • subdirectory

    SubDir

Targets

    • Target

      yourcute.exe

    • Size

      3.1MB

    • MD5

      561d2b135a6200ef094b222eb47af87a

    • SHA1

      4db2f2254cae3695a0ffa7ccdc13097db254cd8c

    • SHA256

      c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

    • SHA512

      6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094

    • SSDEEP

      49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv

    Score
    10/10
    quasarslavespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks