Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Resubmissions

01/05/2024, 20:18

240501-y3le1shh89 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    240501-y3le1shh89

  • MD5

    3bd6bf06bc9f2aba78d213c57c77c140

  • SHA1

    55f05c794c01e0f799896f1d5054406f217f7b3a

  • SHA256

    3b9ee5e6fb637707a6b3e9e7368a7526858e65211fc435b1b7305e0b020c145e

  • SHA512

    fe3ef6e5878e0372c52129c79cec9ff438ea8c556de36d74f773591b41a55703f49c946a42e0eb6505468d9176eb74268f589710207fcb9861287c628af6f2c5

  • SSDEEP

    49152:Sv0lL26AaNeWgPhlmVqvMQ7XSK0CR1J62oGd9THHB72eh2NT:SvUL26AaNeWgPhlmVqkQ7XSK0Cv

Score
10/10
quasarseroxen (real)spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SeroXen (real)

C2

series-pencil.gl.at.ply.gg:59416

Mutex

611a9904-d30b-4e85-814d-180ff05ceafa

Attributes
  • encryption_key

    77B972BEE3F2C17A183AD106C8F8A1CFD8E24211

  • install_name

    Run.exe

  • log_directory

    $77-Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Security

  • subdirectory

    $77-Aetherium

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      3bd6bf06bc9f2aba78d213c57c77c140

    • SHA1

      55f05c794c01e0f799896f1d5054406f217f7b3a

    • SHA256

      3b9ee5e6fb637707a6b3e9e7368a7526858e65211fc435b1b7305e0b020c145e

    • SHA512

      fe3ef6e5878e0372c52129c79cec9ff438ea8c556de36d74f773591b41a55703f49c946a42e0eb6505468d9176eb74268f589710207fcb9861287c628af6f2c5

    • SSDEEP

      49152:Sv0lL26AaNeWgPhlmVqvMQ7XSK0CR1J62oGd9THHB72eh2NT:SvUL26AaNeWgPhlmVqkQ7XSK0Cv

    Score
    10/10
    quasarseroxen (real)spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks