Overview

overview

10

Static

static

10

b6d6761fc3...cs.exe

windows7-x64

10

b6d6761fc3...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b6d6761fc3f0e0b6518d20eb1016d760_NeikiAnalytics

  • Size

    3.1MB

  • Sample

    240513-pbnxdseg47

  • MD5

    b6d6761fc3f0e0b6518d20eb1016d760

  • SHA1

    5b805e1f29044e08094bd4774c1b8ebe41d2c42d

  • SHA256

    5281b2bb67cb6f582fb2218b20c9b215bf26fd42eba684fc1104e031bd0ac553

  • SHA512

    00c3aa8dc5c56f8bc08d851f714d175751a9f08f3a021747ab269e8ecde57aa3accc945269e38fd7dc40db6408176ff747f78c4d38834a2f96c7354bf42ef710

  • SSDEEP

    49152:mvUt62XlaSFNWPjljiFa2RoUYIwR53kar3LoGdzETHHB72eh2NT:mvI62XlaSFNWPjljiFXRoUYIQ31

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.0.0.61:4782

Mutex

9fdd3e80-d560-431b-b526-3ebbc1799110

Attributes
  • encryption_key

    5F91B88C67A9ACF78B2396771B3B6F2B4615CA57

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      b6d6761fc3f0e0b6518d20eb1016d760_NeikiAnalytics

    • Size

      3.1MB

    • MD5

      b6d6761fc3f0e0b6518d20eb1016d760

    • SHA1

      5b805e1f29044e08094bd4774c1b8ebe41d2c42d

    • SHA256

      5281b2bb67cb6f582fb2218b20c9b215bf26fd42eba684fc1104e031bd0ac553

    • SHA512

      00c3aa8dc5c56f8bc08d851f714d175751a9f08f3a021747ab269e8ecde57aa3accc945269e38fd7dc40db6408176ff747f78c4d38834a2f96c7354bf42ef710

    • SSDEEP

      49152:mvUt62XlaSFNWPjljiFa2RoUYIwR53kar3LoGdzETHHB72eh2NT:mvI62XlaSFNWPjljiFXRoUYIQ31

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks