General

  • Target

    Synapse-X-Revamped-main.zip

  • Size

    12.4MB

  • Sample

    240513-v35xwafd6s

  • MD5

    79a56ccfbe243356983bf2726e358b87

  • SHA1

    e47f1e239cf6cd0a19c75ca1da3575b54baf2c07

  • SHA256

    aaf20e1523773d6a7f05297cb48c01b63ce2538ea47403191ff6cdc9f364b148

  • SHA512

    7eeecec2b97bef9cb81b4d5c0d5733fe1217e8281bc482f6bc15187d8d15f6dec84a561917afe346029a5c11c088d3d6bc6aea3f63263f5c2b560cee1521309e

  • SSDEEP

    196608:BS1K3wLGciyPBpxMlHtB+C3rcmrMxyeAO+53AZw7Y2CrzTLaBjPJWvj1YpXHHx4w:BSk9iBvU/7VrERDUUw7iTqJ/RWw

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

C2

espinyskibidi-29823.portmap.host:29823

Mutex

a94ba996-69af-4720-85e6-f4929c5eb0f8

Attributes
  • encryption_key

    6F721445F7E0B1CF58980D84A9D49F4458D4EFD9

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update Startup

  • subdirectory

    Windows Update

Targets

    • Target

      Synapse-X-Revamped-main/CefSharp.BrowserSubprocess.Core.dll

    • Size

      912KB

    • MD5

      67e9fdff12286ad0ff11aa7e8a7775d9

    • SHA1

      245ec015e953bb395cf5d1e4f54804166daeaf68

    • SHA256

      b184f42ad13993a963700ad40400d401e398a46f72056f5907b6acdff986c63d

    • SHA512

      42c068e0b157fa5bd9ec9be977c1ec44712fc78909efb64961dc1e34d6c7fccc7af6bb685e847f32da9fe9124a215ad3adea08317279851c8ffd2761a3b47870

    • SSDEEP

      24576:uVK+vDCBGb9UKpUzXoiYehQspQ8SdWHubiWyzIrQK0OXPOlNce+pi:RcUKpUzXoiYehQspQ8SdWHubiWyzIrQO

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/CefSharp.Core.dll

    • Size

      1.3MB

    • MD5

      a44554d38b7a25a7ab2320fe731c5298

    • SHA1

      c287a88fd3a064b387888f4bbc37a0630c877253

    • SHA256

      35980974bdba6d5dd6a4dc1072e33aab77f72f56c46779cb0216e4801dcc36ab

    • SHA512

      bd8956b7e8ca6d1129fbbb950dd913183b3e92601c2c900aed26d695782e4663654ac57074e1f0f2efcf9cced969487162910dc9bb52b42572d61994b07f2aad

    • SSDEEP

      24576:yXIdphyvfDVKyFnp89jCbBNr0s7HQAqcwYhPolDexla9e6dhkOi0nK+++evP4ZcC:HsJKyzNr0s7HQAqcwYhPolDexla9e6dp

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/CefSharp.Wpf.dll

    • Size

      83KB

    • MD5

      1533d9b2ed991ad4fecef548dc762565

    • SHA1

      7a0664cc6bdc5ffd23c4aba43fa7b2acdfe949f4

    • SHA256

      8e6e874d51f654c1c081cd1658a2e4ad8e3b92e74f9406e8c4eb34d354ab8791

    • SHA512

      710677d3c6ebff9da638d22a3ae800eb12ba947aad9acb4e42f9e9268ade1b8dde680b4aa135121851285943aecc0fc9be85c5ca8a269d6857b35e905c7b7c12

    • SSDEEP

      1536:VdX1kcRoMy1tkZBjxQVhfcmzedNTppNCSyh1FPmyGx8Nge8Fu/mGmDtcOd:VdFLoMk24ClwNge8FPGMf

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/CefSharp.dll

    • Size

      219KB

    • MD5

      92defcf3ee31db03999e8ea41742f8f8

    • SHA1

      2d5a94c029e1ac0df07a2055f03ca3d77ceb76b6

    • SHA256

      d3873ec8cf9a80b3b5691445cd0f6d2a38f5a2432864d7fa372b751bad54e891

    • SHA512

      d58f4c6bf526ed5e19bbb9c36db8fa192c63eb770b8bb5cebef0e1baf69d35ec3e1367062b9d2af9aa654d97e9cdcecca9c12bc73d9097c38a9c7e6dc11f103a

    • SSDEEP

      3072:dLU+ln+doWgHRVIceekE8Nb3+hwx6vOc5jOpP6AOSrzHnZpy:Rh+dYI4dwx6Oc5MPPpH

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/Synapse X Launcher.exe

    • Size

      3.2MB

    • MD5

      3854a6572a9a5a25bccbd13664713915

    • SHA1

      b7c3ca681c1dcb328113c5966bbd96aed541ae64

    • SHA256

      6c4367e763852b7afe852905e9d7baba18ac33c1e4eaf8370350824fb3ffce86

    • SHA512

      80fb1425c57d7984da87349efdc0c4508296b58548e62ee4743215edd1058818154cb1207b95ec74299c7b61953f19f71c6ab0d325126efd21d8c5749ad69452

    • SSDEEP

      49152:pvblL26AaNeWgPhlmVqvMQ7XSKB/RJ6UbR3LoGdM+THHB72eh2NTgj:pvBL26AaNeWgPhlmVqkQ7XSKB/RJ6e

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    • Target

      Synapse-X-Revamped-main/SynapseInjector.dll

    • Size

      6.0MB

    • MD5

      9b248dfff1d2b73fd639324741fe2e08

    • SHA1

      e82684cd6858a6712eff69ace1707b3bcd464105

    • SHA256

      39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e

    • SHA512

      56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c

    • SSDEEP

      98304:whgYUp+QvBY2uccY07B1nG9CHvaxFNErtcKXc17TEBT0VBTFX3NwwJqOft:w2j8YCRGEP0iOvuT0FXKwt

    Score
    9/10
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

    • Target

      Synapse-X-Revamped-main/chrome_elf.dll

    • Size

      788KB

    • MD5

      6499ea6b92ab4971886bd06c12625819

    • SHA1

      5ebb75eeca7625b9511233158a02f50a92867a39

    • SHA256

      6820f276c0d71557a0c7b997fd2f4a3ac6a45c86454c4dc3bcfa29843b5c470b

    • SHA512

      e57703730e42eb9d80e762337e08176705b349f54fbd429edc657d44c9dc3a1f9ccfa594bc3ef622798aebb5bc69b225abb266b00f9b350ae59f734c2f31f63d

    • SSDEEP

      12288:bCr6Tisy+fUv6cwQhl0j+iBQIR+ybWlkkswiS1cVlqoKe9+nIMQbNt:Wr6Tisy+fUv6cwQhlcbWFi8iDjD

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/d3dcompiler_47.dll

    • Size

      3.5MB

    • MD5

      f76b1d2cd95385b21e61874761ddb53a

    • SHA1

      e5219dc55dcd6b8643e3920ad21d0640fd714383

    • SHA256

      8bf0eeb5081d8397e2f84f69449c8a80d9c0cdcf82bcef7a484309046adcb081

    • SHA512

      8e5c6541bbea6730c4f6392439454f516d56ac9ad6d6b55336e52361cc80a35fbed8a90d58020d92fa4ac9fcfeee6c280754a9e99cc32bae901b00306626e69f

    • SSDEEP

      49152:fjmJAksRXmBNgC9ITPPE8WHmy0HRZ+kyOzDJn5c5v5H3pqC23u6q+25omPEyXzjl:fy2Ckrj+kyOv2MJ+6q8kbqS/Ai

    Score
    3/10
    • Target

      Synapse-X-Revamped-main/libEGL.dll

    • Size

      306KB

    • MD5

      a6bff6c3e64d7e0b93361c7696783e96

    • SHA1

      b86339ad28e87c523b6c8bf9ff8787d5d390bd51

    • SHA256

      f808b62775fd4a422e4fcff733ef185e7846e76c533e464cfeaddc96a25a8887

    • SHA512

      c271243438ba54f27d6bd02d38ba4620199fda0ba9b373bfb7522fd128fc32e4028ff9ef9e02668f78c0f86446af3b3a4f8fcc2263e53301553f9a140816e65f

    • SSDEEP

      6144:wfGwxWv6tN2phvpaKHBvb5ZzaYudGGWMfe/tpEEfh8odAcHH6cG:w+wxWyn2pFvb5ZzIsGWMfe/TtSodVn6c

    Score
    1/10
    • Target

      Synapse-X-Revamped-main/libGLESv2.dll

    • Size

      6.4MB

    • MD5

      48bd3bf564d6592417ee5cae16e34e6e

    • SHA1

      f29f91d5863be99267cec7bbe8cb51159a7a3adf

    • SHA256

      53a7ea40cd589683dfb57ee0f187d6f3e373b2df5a3e0129c41a5c1e7de5d0c0

    • SHA512

      c9da5cc25b29bf1b5cdc3de42650e6d893ae89b8451fb67a8a1e4f5df9d71d503b5e010a17540d46e96c1244d58c2490f0b8d5380a98337cbb7bf13b69101683

    • SSDEEP

      98304:+/p3sY6QaLuk1s0EU0qf8zRfU4WIIIMBtLLdAr16KH57wemx7+lw:E36QffqfGpU4WIyFLdoEQWk

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks