Overview

overview

10

Static

static

10

079513ef52...cs.exe

windows7-x64

10

079513ef52...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079513ef527fbeccb26b23e5e26f1600_NeikiAnalytics

  • Size

    3.4MB

  • Sample

    240512-n1c1radf7y

  • MD5

    079513ef527fbeccb26b23e5e26f1600

  • SHA1

    aa387880a90349cc9ae3f5a53b1f255e51cb9107

  • SHA256

    60bc13d78d5ef441d57434a389501cc93ff8afcd830399f61625d1c33eddccea

  • SHA512

    8939183cfa8e6a3c999d689fd9e9c569bc05700f40336754a8890714a1a8ad1ce6209f4e42c6394930f76b0bcd85559d03b4ef86dfe2ab0efc6fcc5fe9a63c08

  • SSDEEP

    49152:lv+I22SsaNYfdPBldt698dBcjHVkxNESEik/iWLoGdm1THHB72eh2NT:lvz22SsaNYfdPBldt6+dBcjHWxRY

Score
10/10
quasardiscordspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Discord

C2

anonam39-28434.portmap.io:28434

Mutex

05aac410-7e7c-4d54-8ab3-5dd8debced86

Attributes
  • encryption_key

    988A53977562DB64E94AB77416B59FECD5DEB50D

  • install_name

    Discord.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    a7

Targets

    • Target

      079513ef527fbeccb26b23e5e26f1600_NeikiAnalytics

    • Size

      3.4MB

    • MD5

      079513ef527fbeccb26b23e5e26f1600

    • SHA1

      aa387880a90349cc9ae3f5a53b1f255e51cb9107

    • SHA256

      60bc13d78d5ef441d57434a389501cc93ff8afcd830399f61625d1c33eddccea

    • SHA512

      8939183cfa8e6a3c999d689fd9e9c569bc05700f40336754a8890714a1a8ad1ce6209f4e42c6394930f76b0bcd85559d03b4ef86dfe2ab0efc6fcc5fe9a63c08

    • SSDEEP

      49152:lv+I22SsaNYfdPBldt698dBcjHVkxNESEik/iWLoGdm1THHB72eh2NT:lvz22SsaNYfdPBldt6+dBcjHWxRY

    Score
    10/10
    quasardiscordspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks