Overview

overview

10

Static

static

1

Client-built.bat

windows7-x64

8

Client-built.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.bat

  • Size

    1.9MB

  • Sample

    240512-sr8taacb3t

  • MD5

    ca98faeecf7f69f417e6b8e706986b2e

  • SHA1

    2ed0d04b476658f57e50b86dba53cdc0edb379e8

  • SHA256

    69d3f18cd40fe951e863d6f7cb34f623ae1f169a030c166efd713630744b14da

  • SHA512

    ad3a6e51492f68bf623b08d01d8d9cc9bc58a6496e04c734ddacd2be120987f56ff228bf24f92a67aff408d801a670cfbb83564907219523776b7a8263b41d64

  • SSDEEP

    24576:DqPPl9YNqSrDNfqgg4edWKa1tpD0jH3F8DbFkBNKUXuiFgZULkB4VmVc0i6MwGxb:W1cqzx/WOrBSkQJ8b

Score
10/10
quasarnewexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.0.0

Botnet

New

C2

even-lemon.gl.at.ply.gg:33587

Mutex

2bce5514-d527-4787-825c-3042f9dd5ede

Attributes
  • encryption_key

    501DB7A849356BF2C272A70D53FAF39F17D4245C

  • install_name

    WinHost32.exe

  • log_directory

    UpdateLogs

  • reconnect_delay

    3000

  • startup_key

    Powershell

  • subdirectory

    System32

Targets

    • Target

      Client-built.bat

    • Size

      1.9MB

    • MD5

      ca98faeecf7f69f417e6b8e706986b2e

    • SHA1

      2ed0d04b476658f57e50b86dba53cdc0edb379e8

    • SHA256

      69d3f18cd40fe951e863d6f7cb34f623ae1f169a030c166efd713630744b14da

    • SHA512

      ad3a6e51492f68bf623b08d01d8d9cc9bc58a6496e04c734ddacd2be120987f56ff228bf24f92a67aff408d801a670cfbb83564907219523776b7a8263b41d64

    • SSDEEP

      24576:DqPPl9YNqSrDNfqgg4edWKa1tpD0jH3F8DbFkBNKUXuiFgZULkB4VmVc0i6MwGxb:W1cqzx/WOrBSkQJ8b

    Score
    10/10
    executionquasarnewspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks