Overview

overview

10

Static

static

10

Sxr_Installer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sxr_Installer.bat

  • Size

    409KB

  • Sample

    240523-swgwcsff9x

  • MD5

    9eaba1c208b8e7a0c94c109e60c5b113

  • SHA1

    a602439a57a44287dff1d980d2c959c0d934a9e4

  • SHA256

    ab6f4a4fa9bbdf8d9461023a2819b76b07d93e7d31e9d97a490f8ed4c0c0dccc

  • SHA512

    625363f1203596200cd6fdc7c9f9ce8b6af0634299dc750f490305822385d8915981c8c7a162588959dbf000a7d8b4af8d61352fd84a176207c592ded2f87fa6

  • SSDEEP

    6144:cM8epTb9xiovsu3xkkMLK6EuqFHg600SsDMjboALeOu9t8Zyd6/TXQQxZoIv:bp/9xisjxkkMQuWMwgun8Zk67XtxZZv

Score
10/10
quasarseroxenspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

chinese-golden.gl.at.ply.gg:44086

Mutex

$Sxr-8pC7X2mG070btopC86

Attributes
  • encryption_key

    X7DsXqksH10Qr4Gz4fsk

  • install_name

    HAHAHAHAHA LMAOO.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Svhost

  • subdirectory

    SubDir

Targets

    • Target

      Sxr_Installer.bat

    • Size

      409KB

    • MD5

      9eaba1c208b8e7a0c94c109e60c5b113

    • SHA1

      a602439a57a44287dff1d980d2c959c0d934a9e4

    • SHA256

      ab6f4a4fa9bbdf8d9461023a2819b76b07d93e7d31e9d97a490f8ed4c0c0dccc

    • SHA512

      625363f1203596200cd6fdc7c9f9ce8b6af0634299dc750f490305822385d8915981c8c7a162588959dbf000a7d8b4af8d61352fd84a176207c592ded2f87fa6

    • SSDEEP

      6144:cM8epTb9xiovsu3xkkMLK6EuqFHg600SsDMjboALeOu9t8Zyd6/TXQQxZoIv:bp/9xisjxkkMQuWMwgun8Zk67XtxZZv

    Score
    10/10
    quasarseroxenspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks