Overview

overview

10

Static

static

3

303775c9ad...18.exe

windows7-x64

10

303775c9ad...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    303775c9adc3380f20ce1e6ebf6d3a1e_JaffaCakes118

  • Size

    213KB

  • Sample

    240510-vzm8nagh3y

  • MD5

    303775c9adc3380f20ce1e6ebf6d3a1e

  • SHA1

    cdc095814bb120f51be73728f78dbe29e82eea9d

  • SHA256

    f8cce268eecf24bebe0d96991f7013921fd9eb34570a09acfd6ad8fb6ff198f9

  • SHA512

    94bd19ef4703790b819a211eb348186d7002eb8d9f96eef1253a447dd2e1df9eb8462b9fa1173ee6f49787083c49f4ee095c0693f85962575ae804e8bd349625

  • SSDEEP

    6144:/+8ZepOGuDnw9tOJavXhe9Tedm/8b1tnawa:/jZepgDj44IyctnE

Score
10/10
quasarspywaretrojan

Malware Config

Targets

    • Target

      303775c9adc3380f20ce1e6ebf6d3a1e_JaffaCakes118

    • Size

      213KB

    • MD5

      303775c9adc3380f20ce1e6ebf6d3a1e

    • SHA1

      cdc095814bb120f51be73728f78dbe29e82eea9d

    • SHA256

      f8cce268eecf24bebe0d96991f7013921fd9eb34570a09acfd6ad8fb6ff198f9

    • SHA512

      94bd19ef4703790b819a211eb348186d7002eb8d9f96eef1253a447dd2e1df9eb8462b9fa1173ee6f49787083c49f4ee095c0693f85962575ae804e8bd349625

    • SSDEEP

      6144:/+8ZepOGuDnw9tOJavXhe9Tedm/8b1tnawa:/jZepgDj44IyctnE

    Score
    10/10
    quasarspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks