Overview

overview

10

Static

static

10

Client-built.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    240519-lvzapacg7w

  • MD5

    22100cc98b67f5dcb53996c6e159307e

  • SHA1

    c52c5993155d25849412f7e0aad949982b79e184

  • SHA256

    8d2791e3b86cbe959a01b8394dc1b1a469e8bc2263088f0ebd14db7b123a3fa8

  • SHA512

    e177d46a50715a15a569cacced329e1076363a93ba0a60e816e0faef0d71745df5a8185409f536d773dfcae664bcccd3e883cb7959c3e0e0b5a18085ab5b29e0

  • SSDEEP

    49152:3vDI22SsaNYfdPBldt698dBcjHueA3har7QoGd29JTHHB72eh2NT:3v822SsaNYfdPBldt6+dBcjHg3h

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.2.106:4782

Mutex

fe4290a2-c368-468a-8c1f-b36f1774e2d7

Attributes
  • encryption_key

    6FC043E55EFEB9F593029AF4D1E1023ED290CDEE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      22100cc98b67f5dcb53996c6e159307e

    • SHA1

      c52c5993155d25849412f7e0aad949982b79e184

    • SHA256

      8d2791e3b86cbe959a01b8394dc1b1a469e8bc2263088f0ebd14db7b123a3fa8

    • SHA512

      e177d46a50715a15a569cacced329e1076363a93ba0a60e816e0faef0d71745df5a8185409f536d773dfcae664bcccd3e883cb7959c3e0e0b5a18085ab5b29e0

    • SSDEEP

      49152:3vDI22SsaNYfdPBldt698dBcjHueA3har7QoGd29JTHHB72eh2NT:3v822SsaNYfdPBldt6+dBcjHg3h

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Matrix

Tasks