General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    240330-3vve6shf3z

  • MD5

    140ba91b54b2acf429d7e75a13caeb18

  • SHA1

    e3ea0109d58ac9e910dbeb1b62c3bef6f291dba2

  • SHA256

    1eed991a56a7502098e609107529d75bc3945f25436998d3d482a0b8adf63592

  • SHA512

    2c83f7336c6226cabbef55be1d9509d1ff616d24aa79fe1d47475126048423ade2ad560f5f304adf8e928b0897d491fcb63ab9824288807b5793d69cbb81ab45

  • SSDEEP

    49152:CvchBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkafCp1Jn+oGddETHHB72eh2NT:CvWt2d5aKCuVPzlEmVQ0wvwffCI

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Quasar

C2

140.238.91.110:42341

Mutex

0e8e41e6-9099-467f-a6ec-db817501dcc7

Attributes
  • encryption_key

    E6C50EA35F1AB6A8B7E919CD72CECF2C57B6D1AE

  • install_name

    WindowsUpdater.exe

  • log_directory

    Windows Error Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Boot Menu x64

  • subdirectory

    Windows

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      140ba91b54b2acf429d7e75a13caeb18

    • SHA1

      e3ea0109d58ac9e910dbeb1b62c3bef6f291dba2

    • SHA256

      1eed991a56a7502098e609107529d75bc3945f25436998d3d482a0b8adf63592

    • SHA512

      2c83f7336c6226cabbef55be1d9509d1ff616d24aa79fe1d47475126048423ade2ad560f5f304adf8e928b0897d491fcb63ab9824288807b5793d69cbb81ab45

    • SSDEEP

      49152:CvchBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkafCp1Jn+oGddETHHB72eh2NT:CvWt2d5aKCuVPzlEmVQ0wvwffCI

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks