Overview

overview

10

Static

static

10

Token Generator.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Token Generator.exe

  • Size

    3.1MB

  • Sample

    240527-2a6r2adc62

  • MD5

    6d2ad4ada4961027832e557db06fc08d

  • SHA1

    816018499f5e291850d7dd2a0d15c914e5607630

  • SHA256

    139ce0f6ed1d745a6776f831c641b2b30bb8d48ecd9c198a0b4bd8489899f60e

  • SHA512

    1d99985c99fa16f712eee5604279463e18e77532e7a1586651178685ef38ba25b099c393edc44f2703d7e9f4ce7596b86ba3d9f0e00119e13474816a2186f241

  • SSDEEP

    49152:uvSI22SsaNYfdPBldt698dBcjH9tDSh1J6LoGdLlTHHB72eh2NT:uv/22SsaNYfdPBldt6+dBcjHTDSG

Score
10/10
quasartoken genspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Token Gen

C2

uk2.localto.net:6103

Mutex

0c14e9f2-6918-4e50-8463-04ad871c1e3d

Attributes
  • encryption_key

    6BE0D74806BB58E6DB21FA6E3B6DB38B4A72BAFC

  • install_name

    $77-powershell.exe

  • log_directory

    $77-Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    $77-Rootkit

Targets

    • Target

      Token Generator.exe

    • Size

      3.1MB

    • MD5

      6d2ad4ada4961027832e557db06fc08d

    • SHA1

      816018499f5e291850d7dd2a0d15c914e5607630

    • SHA256

      139ce0f6ed1d745a6776f831c641b2b30bb8d48ecd9c198a0b4bd8489899f60e

    • SHA512

      1d99985c99fa16f712eee5604279463e18e77532e7a1586651178685ef38ba25b099c393edc44f2703d7e9f4ce7596b86ba3d9f0e00119e13474816a2186f241

    • SSDEEP

      49152:uvSI22SsaNYfdPBldt698dBcjH9tDSh1J6LoGdLlTHHB72eh2NT:uv/22SsaNYfdPBldt6+dBcjHTDSG

    Score
    10/10
    quasartoken genspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks