Overview

overview

10

Static

static

10

Bloxstrap-...in.zip

windows7-x64

1

Bloxstrap-...in.zip

windows10-2004-x64

1

Bloxstrap-....1.exe

windows7-x64

10

Bloxstrap-....1.exe

windows10-2004-x64

10

Bloxstrap-...I2.dll

windows7-x64

1

Bloxstrap-...I2.dll

windows10-2004-x64

1

Bloxstrap-...el.sys

windows10-2004-x64

1

Bloxstrap-...er.dll

windows7-x64

1

Bloxstrap-...er.dll

windows10-2004-x64

3

Bloxstrap-...ec.lnk

windows7-x64

3

Bloxstrap-...ec.lnk

windows10-2004-x64

3

Bloxstrap-...ce.lnk

windows7-x64

3

Bloxstrap-...ce.lnk

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Bloxstrap-v2.5.1-main.zip
  • Size 2.0MB
  • Sample240510-qata6abc72
  • SHA256 e46ddb2b2b2cc74e8306adc682228969d35e2943a917e321bd5db72e744d2d05
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslaquasaroffice04spywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 192.168.1.114:4782

Mutex

  • 10d94abb-0198-407e-aa98-bb80c5b37835

Attributes
  • encryption_key

    45C885494447187E9FBAD6C4E1ACD4A1590FC706

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Runtime

  • subdirectory

    SubDir

Targets

    • Target
      Bloxstrap-v2.5.1-main.zip
    • Size 2.0MB
    • SHA256 e46ddb2b2b2cc74e8306adc682228969d35e2943a917e321bd5db72e744d2d05
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      Bloxstrap-v2.5.1-main/BloxStrap v2.5.4.1.exe
    • Size 3.1MB
    • SHA256 52f9d1a2c3d4518da21b3426a0ccefb04e07316755f97de9eaaecc1e09c4b5c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral3behavioral4
    • Target
      Bloxstrap-v2.5.1-main/Guna.UI2.dll
    • Size 2.1MB
    • SHA256 9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      Bloxstrap-v2.5.1-main/Kernel.sys
    • Size 23KB
    • SHA256 03eecdd2a3c0096450c674928b4064507134ff5eebffe7ee862e7bb21d528caf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      Bloxstrap-v2.5.1-main/WebView2Loader.dll
    • Size 112KB
    • SHA256 9d5918cec81470225be7478c7e092c24f248e8caa824d667fb57431cad94be71
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral8behavioral9
    • Target
      Bloxstrap-v2.5.1-main/autoexec.lnk
    • Size 1KB
    • SHA256 9f8630f7a53624a066fbe2e82755bafab17263569ca005b3f56d83822ad53e93
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral11
    • Target
      Bloxstrap-v2.5.1-main/aworkspace.lnk
    • Size 1KB
    • SHA256 ce3541c501a821014f09f04f770a978c48c31bb134fec2eafdfe0a35d19aa737
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral12behavioral13

MITRE ATT&CK Enterprise v15

Tasks