Overview

overview

10

Static

static

10

ClientC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ClientC.exe

  • Size

    3.1MB

  • Sample

    240520-vhlcqsae4y

  • MD5

    60283841a32e701810a4f2d92bd992ab

  • SHA1

    e87d9569a7d037279814a12be25665208071ab91

  • SHA256

    2ed6f46f965ff50c50cc8414b091745f36d4301e35a7a975bf9f2625b24f8326

  • SHA512

    4e0ba404eaa0d823d7044f76ae0bbccb78c5d607843b33859a1c5a47f852ff040c86acc02e335f7235d4848f92e2c20f329ea5c898bd7960cc356225f06c4d97

  • SSDEEP

    49152:yvkt62XlaSFNWPjljiFa2RoUYIPqRJ6vbR3LoGd/qtTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIPqRJ6BP

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

156.57.236.38:1162

Mutex

eeb96fcd-c654-4ba2-9a84-d3d5cfa5eee3

Attributes
  • encryption_key

    7A857EF3A3EB39AF399F1F3800FB9F842DC83C9E

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    1

  • startup_key

    InsertDelete

  • subdirectory

    SubDir

Targets

    • Target

      ClientC.exe

    • Size

      3.1MB

    • MD5

      60283841a32e701810a4f2d92bd992ab

    • SHA1

      e87d9569a7d037279814a12be25665208071ab91

    • SHA256

      2ed6f46f965ff50c50cc8414b091745f36d4301e35a7a975bf9f2625b24f8326

    • SHA512

      4e0ba404eaa0d823d7044f76ae0bbccb78c5d607843b33859a1c5a47f852ff040c86acc02e335f7235d4848f92e2c20f329ea5c898bd7960cc356225f06c4d97

    • SSDEEP

      49152:yvkt62XlaSFNWPjljiFa2RoUYIPqRJ6vbR3LoGd/qtTHHB72eh2NT:yv462XlaSFNWPjljiFXRoUYIPqRJ6BP

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks