Resubmissions

27-04-2024 00:51

240427-a7s4nagd6x 10

27-04-2024 00:50

240427-a65q3afd73 1

General

  • Target

    https://is.gd/147852z

  • Sample

    240427-a7s4nagd6x

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

ddqszqwdq.zapto.org:4782

Mutex

a6e72740-75f8-4569-9d6b-650286c4ff34

Attributes
  • encryption_key

    4586CDEAC9B29D84A4925415D110E19EDB8D0A8B

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    test

  • subdirectory

    Kami

Targets

    • Target

      https://is.gd/147852z

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks