Overview

overview

10

Static

static

10

SynapseX.R....5.rar

windows7-x64

10

SynapseX.R....5.rar

windows10-2004-x64

3

SynapseX R...er.exe

windows7-x64

10

SynapseX R...er.exe

windows10-2004-x64

10

SynapseX R...or.dll

windows7-x64

9

SynapseX R...or.dll

windows10-2004-x64

9

Resubmissions

28/05/2024, 02:35

240528-c3cl8acg6510

28/05/2024, 02:34

240528-c2ncbsbe8y10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SynapseX.Revamped.V1.5.rar
  • Size 6.9MB
  • Sample240528-c3cl8acg65
  • SHA256 8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasarwindows updateevasionspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Windows Update

C2

  • skbidiooiilet-31205.portmap.host:31205

Mutex

  • b2f09b33-2e5b-4ffa-afbf-3f1aaed274a6

Attributes
  • encryption_key

    6F721445F7E0B1CF58980D84A9D49F4458D4EFD9

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsUpdate

  • subdirectory

    Windows Update

Targets

    • Target
      SynapseX.Revamped.V1.5.rar
    • Size 6.9MB
    • SHA256 8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasarwindows updatespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2
    • Target
      SynapseX Revamped V1.5/SynapseXBootstrapper.exe
    • Size 3.1MB
    • SHA256 de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasarwindows updatespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral3behavioral4
    • Target
      SynapseX Revamped V1.5/bin/SynapseInjector.dll
    • Size 6.0MB
    • SHA256 39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    evasiontrojan

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks