Overview

overview

10

Static

static

10

0x000a0000...-7.exe

windows7-x64

10

0x000a0000...-7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x000a000000013a21-7.dat

  • Size

    3.1MB

  • Sample

    240517-jh321agc56

  • MD5

    f91699f2ff3f446461a302ea2d69be44

  • SHA1

    caf1e89a10b97668773e6150dd4b3cecee194c86

  • SHA256

    bccae30d15564418d4f8ee309c47adaa054039a1a68ea59ee95b6a5ef92d8487

  • SHA512

    2eb25181445c88044960ad65417cee3c14d83be935c6fc471288687b02c3113851b7b4c980b73994d90688f6e551eeb76001e8cfc120922dacbd5d8c7e3cbc4d

  • SSDEEP

    49152:/vOlL26AaNeWgPhlmVqvMQ7XSK0FIkEiU3k/KLoGddq3THHB72eh2NT:/v+L26AaNeWgPhlmVqkQ7XSKuI3

Score
10/10
quasarwebhookspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Webhook

C2

bardu3662.duckdns.org:9733

Mutex

afa58199-2aae-4e08-8ef4-8e4ef39bc0aa

Attributes
  • encryption_key

    080342EF5ED2B5D16317695CC4327BF2FFC034AA

  • install_name

    RuntimeBroker.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Update

  • subdirectory

    ApplicationFrameHost

Targets

    • Target

      0x000a000000013a21-7.dat

    • Size

      3.1MB

    • MD5

      f91699f2ff3f446461a302ea2d69be44

    • SHA1

      caf1e89a10b97668773e6150dd4b3cecee194c86

    • SHA256

      bccae30d15564418d4f8ee309c47adaa054039a1a68ea59ee95b6a5ef92d8487

    • SHA512

      2eb25181445c88044960ad65417cee3c14d83be935c6fc471288687b02c3113851b7b4c980b73994d90688f6e551eeb76001e8cfc120922dacbd5d8c7e3cbc4d

    • SSDEEP

      49152:/vOlL26AaNeWgPhlmVqvMQ7XSK0FIkEiU3k/KLoGddq3THHB72eh2NT:/v+L26AaNeWgPhlmVqkQ7XSKuI3

    Score
    10/10
    quasarwebhookspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks