Overview

overview

10

Static

static

10

SkermEXEC.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SkermEXEC.exe

  • Size

    3.1MB

  • Sample

    240518-14dgxaah96

  • MD5

    6a71076b831fec1a4549e5a0aeed86dd

  • SHA1

    e0473ef4986c038523c256142ed75e957230ccc9

  • SHA256

    3c25cfef01b208e4c7b01f28a5172753dd536edb8bed8e58144d178f87761c46

  • SHA512

    48e4f4a2bb8428f8dc79eb86425cbb2c0b59c984d4e526fc08c3f816fd8fbf8854aec292ec4f6385eacddc185fa35e97c13c666e6e754ee6289e42884ffd77ef

  • SSDEEP

    49152:6vkt62XlaSFNWPjljiFa2RoUYIj3L3nar9LoGd13THHB72eh2NT:6v462XlaSFNWPjljiFXRoUYIv3C

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.68.100:4782

Mutex

f195a5f9-5b8a-4ef1-ba41-ce79c45d3dad

Attributes
  • encryption_key

    AAD5CB2ED96AC29ECF5D4BB5B9A38449017E4CAA

  • install_name

    SkermEXEC.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Runtime Broker

  • subdirectory

    SubDir

Targets

    • Target

      SkermEXEC.exe

    • Size

      3.1MB

    • MD5

      6a71076b831fec1a4549e5a0aeed86dd

    • SHA1

      e0473ef4986c038523c256142ed75e957230ccc9

    • SHA256

      3c25cfef01b208e4c7b01f28a5172753dd536edb8bed8e58144d178f87761c46

    • SHA512

      48e4f4a2bb8428f8dc79eb86425cbb2c0b59c984d4e526fc08c3f816fd8fbf8854aec292ec4f6385eacddc185fa35e97c13c666e6e754ee6289e42884ffd77ef

    • SSDEEP

      49152:6vkt62XlaSFNWPjljiFa2RoUYIj3L3nar9LoGd13THHB72eh2NT:6v462XlaSFNWPjljiFXRoUYIv3C

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks