Overview

overview

10

Static

static

1

Uni.bat

windows7-x64

1

Uni.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Uni.bat

  • Size

    5.1MB

  • Sample

    240325-lspcpsfe2x

  • MD5

    23437e2baad94ab4255396007b06b3eb

  • SHA1

    ebd04f77aa36f67a48e855601e31424b4547228d

  • SHA256

    376ecc6bbf3db6782f5548c1d58c5c1a72146f684f395fa6e40253db10834546

  • SHA512

    5d888ba40f8c63a1e8e18f8c152d5ed6aca400455982ee615712dff80ba4fbe719c86c6b7a44227275548cbff75cc23326902b9b2c9c4fa8e9ccb26c89f83589

  • SSDEEP

    24576:bQcksZhAsxYu9bEUt4Qa1CFQa5Z4tp5ljbjvGr2BBgfretKRxMp+hrQB0eJM2a8V:kSbESV0MFJnGRfrnQwsxZLHC

Score
10/10
quasarslavespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:34353

Mutex

25ab9d56-6ef2-47d3-99aa-2142fbcd41fa

Attributes
  • encryption_key

    8E710985199C6BF86CCE90DA92448A36E2F45F51

  • install_name

    XWormV5.6.exe

  • log_directory

    WindowsUPDLogs

  • reconnect_delay

    3000

  • startup_key

    Windows BIOS Update Checker

  • subdirectory

    SubDir

Targets

    • Target

      Uni.bat

    • Size

      5.1MB

    • MD5

      23437e2baad94ab4255396007b06b3eb

    • SHA1

      ebd04f77aa36f67a48e855601e31424b4547228d

    • SHA256

      376ecc6bbf3db6782f5548c1d58c5c1a72146f684f395fa6e40253db10834546

    • SHA512

      5d888ba40f8c63a1e8e18f8c152d5ed6aca400455982ee615712dff80ba4fbe719c86c6b7a44227275548cbff75cc23326902b9b2c9c4fa8e9ccb26c89f83589

    • SSDEEP

      24576:bQcksZhAsxYu9bEUt4Qa1CFQa5Z4tp5ljbjvGr2BBgfretKRxMp+hrQB0eJM2a8V:kSbESV0MFJnGRfrnQwsxZLHC

    Score
    10/10
    quasarslavespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks