Overview

overview

10

Static

static

10

xzczxczxcz...zv.exe

windows7-x64

10

xzczxczxcz...zv.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    xzczxczxczxvxzvxzv.exe

  • Size

    3.1MB

  • Sample

    240512-behb5aca33

  • MD5

    61437e24f20626caa1da68d45dc6349c

  • SHA1

    e8e757aa167f0dfd15528bf26f6465758fbbb6f3

  • SHA256

    b12573a06d210c94325adff99d72041732ee2937d4000a2766afa930dc31bff7

  • SHA512

    8da16a08df45608736fe6cfacad123b54f326b366fd6d4d449f7b5c32c6385d8110813e76767ee35e2093cdb554ea57d1ed8b1d10a4fef4d437d312dfaa7bcce

  • SSDEEP

    49152:NvUI22SsaNYfdPBldt698dBcjH6q6rXMfltoGdXTHHB72eh2NT:NvZ22SsaNYfdPBldt6+dBcjH6q6r+

Score
10/10
quasarshibaspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Shiba

C2

score-seminars.gl.at.ply.gg:35300:35300

Mutex

987c652c-2a4e-4c5d-bc39-00c8c0f35c5c

Attributes
  • encryption_key

    A88D7FED7F655EBDC4F99C21BAE5EC62300AADC7

  • install_name

    $sxr-insta.exe

  • log_directory

    $sxr-logs

  • reconnect_delay

    1000

  • startup_key

    $sxr-mstha

  • subdirectory

    $sxr-start

Targets

    • Target

      xzczxczxczxvxzvxzv.exe

    • Size

      3.1MB

    • MD5

      61437e24f20626caa1da68d45dc6349c

    • SHA1

      e8e757aa167f0dfd15528bf26f6465758fbbb6f3

    • SHA256

      b12573a06d210c94325adff99d72041732ee2937d4000a2766afa930dc31bff7

    • SHA512

      8da16a08df45608736fe6cfacad123b54f326b366fd6d4d449f7b5c32c6385d8110813e76767ee35e2093cdb554ea57d1ed8b1d10a4fef4d437d312dfaa7bcce

    • SSDEEP

      49152:NvUI22SsaNYfdPBldt698dBcjH6q6rXMfltoGdXTHHB72eh2NT:NvZ22SsaNYfdPBldt6+dBcjH6q6r+

    Score
    10/10
    quasarshibaspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks