Overview

overview

10

Static

static

10

265ccc5b2d...cs.exe

windows7-x64

10

265ccc5b2d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    265ccc5b2dc0c825f7d1a65dd3145340_NeikiAnalytics

  • Size

    3.1MB

  • Sample

    240513-11wt3sfe6s

  • MD5

    265ccc5b2dc0c825f7d1a65dd3145340

  • SHA1

    7111d7905bbe47c59a7f1759793f2d2ef6b6c5e1

  • SHA256

    d34a1086238301234ba85e975fadc050a14b224317a0dd211070fe5c4467f18c

  • SHA512

    804c89ee1120334d9dc9009c42ee0dd8568b31afc0f1d045ea39a51acf71817e803a3cf2f31482cee4973da4b7ba6f24eda7f5c4f72c1eaaad7fb26ac33ffec2

  • SSDEEP

    49152:XvmI22SsaNYfdPBldt698dBcjH8tXRJ6mbR3LoGdxQTHHB72eh2NT:Xvr22SsaNYfdPBldt6+dBcjHsXRJ6g

Score
10/10
quasarclientsspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Clients

C2

greenindianman-49703.portmap.host:49703

Mutex

a81b3de7-2166-4055-925d-fe9dc1d9d6bf

Attributes
  • encryption_key

    95AA1BBAC73B9C4A85C5C9CA17AB01066062736A

  • install_name

    WinRar.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Task Manager

  • subdirectory

    WinRar

Targets

    • Target

      265ccc5b2dc0c825f7d1a65dd3145340_NeikiAnalytics

    • Size

      3.1MB

    • MD5

      265ccc5b2dc0c825f7d1a65dd3145340

    • SHA1

      7111d7905bbe47c59a7f1759793f2d2ef6b6c5e1

    • SHA256

      d34a1086238301234ba85e975fadc050a14b224317a0dd211070fe5c4467f18c

    • SHA512

      804c89ee1120334d9dc9009c42ee0dd8568b31afc0f1d045ea39a51acf71817e803a3cf2f31482cee4973da4b7ba6f24eda7f5c4f72c1eaaad7fb26ac33ffec2

    • SSDEEP

      49152:XvmI22SsaNYfdPBldt698dBcjH8tXRJ6mbR3LoGdxQTHHB72eh2NT:Xvr22SsaNYfdPBldt6+dBcjHsXRJ6g

    Score
    10/10
    quasarclientsspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks