Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    240529-tr1y4sbe5t

  • MD5

    18cbd10f11ced1f35a7dc5f62e863d91

  • SHA1

    da4de33e473973786424814e8b7b612e752bf69d

  • SHA256

    2f2614d909692ad18d133b6975a74c8b32eaa1fa56b6dd4e4493fa02663b0b47

  • SHA512

    e75db2e298cf0c5b5e068bd6b4cb6d3a9edfe123a8aed5e6f79c1630feaeb74009482f85fae19ad61fc50b94ce86f3f3784b3a5aceaae3501504a3d2242c27a5

  • SSDEEP

    49152:WvfI22SsaNYfdPBldt698dBcjHt4xNESE7k/iwLoGdZTHHB72eh2NT:Wvw22SsaNYfdPBldt6+dBcjH+xCO

Score
10/10
quasarrobertospywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roberto

C2

26.241.44.19:4782

Mutex

7427195c-1cdf-4d66-a472-3a404043ceb9

Attributes
  • encryption_key

    D5A706652BB816329FA270B05A84E287A9079658

  • install_name

    roberto.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      18cbd10f11ced1f35a7dc5f62e863d91

    • SHA1

      da4de33e473973786424814e8b7b612e752bf69d

    • SHA256

      2f2614d909692ad18d133b6975a74c8b32eaa1fa56b6dd4e4493fa02663b0b47

    • SHA512

      e75db2e298cf0c5b5e068bd6b4cb6d3a9edfe123a8aed5e6f79c1630feaeb74009482f85fae19ad61fc50b94ce86f3f3784b3a5aceaae3501504a3d2242c27a5

    • SSDEEP

      49152:WvfI22SsaNYfdPBldt698dBcjHt4xNESE7k/iwLoGdZTHHB72eh2NT:Wvw22SsaNYfdPBldt6+dBcjH+xCO

    Score
    10/10
    quasarrobertospywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks