Overview

overview

10

Static

static

10

Beta2.exe

windows7-x64

10

Beta2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Beta2.exe

  • Size

    3.1MB

  • Sample

    240530-qe4mpahf9y

  • MD5

    deabfd991ccd55517081cc6d10c58e97

  • SHA1

    98fb943a6714593ebb567b966702fcad7fb1448d

  • SHA256

    dfb168d8f6a43b1348d9ed49f0ab38365f31987512212a8afae9a311f47f135f

  • SHA512

    0f92d1291e4c8469ff8c891a2528d211fc78d3c81b5351f2cd9821077d9aeda7429c271c48f0056c0a12cd290f48156b5d72fe4c333e7ff0fec2b639c1931aea

  • SSDEEP

    49152:6vBt62XlaSFNWPjljiFa2RoUYIhnU2jrozd3oGTHHB72eh2NT:6vr62XlaSFNWPjljiFXRoUYIZU2H

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

arthurus36off.ddns.net:5555

Mutex

8bf6ad28-ed30-4fe9-9644-9753c363c3b0

Attributes
  • encryption_key

    6314C8C60AA1035CEB920FD38F0342E398BAF5D0

  • install_name

    Client2.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WinSysol

Targets

    • Target

      Beta2.exe

    • Size

      3.1MB

    • MD5

      deabfd991ccd55517081cc6d10c58e97

    • SHA1

      98fb943a6714593ebb567b966702fcad7fb1448d

    • SHA256

      dfb168d8f6a43b1348d9ed49f0ab38365f31987512212a8afae9a311f47f135f

    • SHA512

      0f92d1291e4c8469ff8c891a2528d211fc78d3c81b5351f2cd9821077d9aeda7429c271c48f0056c0a12cd290f48156b5d72fe4c333e7ff0fec2b639c1931aea

    • SSDEEP

      49152:6vBt62XlaSFNWPjljiFa2RoUYIhnU2jrozd3oGTHHB72eh2NT:6vr62XlaSFNWPjljiFXRoUYIZU2H

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks