Overview

overview

10

Static

static

10

BoostBot.exe

windows7-x64

10

BoostBot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BoostBot.exe.bin

  • Size

    409KB

  • Sample

    240518-gv37esfa71

  • MD5

    404ab800bbe49c36bd64d0d73600b59a

  • SHA1

    4c8dff2702fada108f7477ad357067310b584366

  • SHA256

    5465f02f24ee5c1fc9c9c27c86c209eeddc2ed607143e1b76ca9c9d9b7b84154

  • SHA512

    d0ecd88adfd84d9d8e845281e0437368aadf3d1d6fb704d7c7630d1360697471c2a49584f968eeebd5b435f11af9ce3d06327f1835fa5d07a140f22c0f95fc11

  • SSDEEP

    12288:dpyJcC+xB0XbJQtlQDFuYAbtP6j8fXx7EBI:zwd+QJQbQYbl6Ivn

Score
10/10
quasarrpadspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

RPad

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-okPqrmZ8kNVUcS4Rp0

Attributes
  • encryption_key

    XmcBnPuLlN1e8SHIRR1z

  • install_name

    $sxr-powershell.exe

  • log_directory

    $SXR-LOGS

  • reconnect_delay

    3000

  • startup_key

    $sxr-powershell

  • subdirectory

    $sxr-seroxen2

Targets

    • Target

      BoostBot.exe.bin

    • Size

      409KB

    • MD5

      404ab800bbe49c36bd64d0d73600b59a

    • SHA1

      4c8dff2702fada108f7477ad357067310b584366

    • SHA256

      5465f02f24ee5c1fc9c9c27c86c209eeddc2ed607143e1b76ca9c9d9b7b84154

    • SHA512

      d0ecd88adfd84d9d8e845281e0437368aadf3d1d6fb704d7c7630d1360697471c2a49584f968eeebd5b435f11af9ce3d06327f1835fa5d07a140f22c0f95fc11

    • SSDEEP

      12288:dpyJcC+xB0XbJQtlQDFuYAbtP6j8fXx7EBI:zwd+QJQbQYbl6Ivn

    Score
    10/10
    quasarrpadspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks