Overview

overview

10

Static

static

3

Ring3.Root...1).exe

windows11-21h2-x64

10

Resubmissions

16/02/2025, 17:48

250216-wdpd9svjgs 3

07/05/2024, 00:17

240507-aldrvahg91 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ring3.Rootkit.Remover (1).exe

  • Size

    151KB

  • Sample

    240507-aldrvahg91

  • MD5

    d58b5b6cfcaf63f9dd9015fadf8e8223

  • SHA1

    f927a187ca142b03f5dc0c49804fb6eb4425f3f3

  • SHA256

    906f16836d4ed91fbaf79a1e21a140a4a29783f3b21e55ae4247f26c1916d70f

  • SHA512

    cb5d0832d00cd5cf72734425d0bae5039e1356a1da1105af6260468e1420e3207d90fbe09a9019134b0a1d6528ff3f84f2b025d6111cde2364eb255c5c885b47

  • SSDEEP

    3072:6J/Rm34y9GUVkpj3KOVgHqMPfKVqcbYA/LzNAtV:6nm34y9D2pj3TgnKVqc0B

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

7.tcp.eu.ngrok.io:14675

Mutex

f9b39692-0d34-4812-978b-6f9b9050f582

Attributes
  • encryption_key

    5764E51D9ADFF0AED509D6714430139D2683E27B

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Ring3.Rootkit.Remover (1).exe

    • Size

      151KB

    • MD5

      d58b5b6cfcaf63f9dd9015fadf8e8223

    • SHA1

      f927a187ca142b03f5dc0c49804fb6eb4425f3f3

    • SHA256

      906f16836d4ed91fbaf79a1e21a140a4a29783f3b21e55ae4247f26c1916d70f

    • SHA512

      cb5d0832d00cd5cf72734425d0bae5039e1356a1da1105af6260468e1420e3207d90fbe09a9019134b0a1d6528ff3f84f2b025d6111cde2364eb255c5c885b47

    • SSDEEP

      3072:6J/Rm34y9GUVkpj3KOVgHqMPfKVqcbYA/LzNAtV:6nm34y9D2pj3TgnKVqc0B

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Blocklisted process makes network request

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks