Overview

overview

10

Static

static

10

Client-built.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.4MB

  • Sample

    240427-nwl3vshg99

  • MD5

    5563db885f9dff8a21515399173729af

  • SHA1

    699f3b02b8708ff390bea58f92380610aef1a016

  • SHA256

    a7213d2f57e96c1cc5e026f53eae26941ef1d64bdb3a588a96b81a3cbef92548

  • SHA512

    bae11f061c5bee115792c8e429b594b8d3980208c67a2f88ea76ccbf298e26978c57f1b32b564e2585c60e9c711d043c20e11f461b887fb1c30eb2731ed9aaac

  • SSDEEP

    98304:CvY62XlaSFNWPjljiFXRoUYIjhRJ6Dux:kQZYsC

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

gaykami.zapto.org:4782

Mutex

fd070244-4e4f-464f-bf66-b0519c62cf67

Attributes
  • encryption_key

    D408429A8F1C644E0A5D5AD709BD41BEADE3C3F6

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.4MB

    • MD5

      5563db885f9dff8a21515399173729af

    • SHA1

      699f3b02b8708ff390bea58f92380610aef1a016

    • SHA256

      a7213d2f57e96c1cc5e026f53eae26941ef1d64bdb3a588a96b81a3cbef92548

    • SHA512

      bae11f061c5bee115792c8e429b594b8d3980208c67a2f88ea76ccbf298e26978c57f1b32b564e2585c60e9c711d043c20e11f461b887fb1c30eb2731ed9aaac

    • SSDEEP

      98304:CvY62XlaSFNWPjljiFXRoUYIjhRJ6Dux:kQZYsC

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks