General

  • Target
    PDennSploit.v1.2.rar
  • Size 14.6MB
  • Sample240602-qkmlcsdc6v
  • SHA256 d981d6d8221ccbf1501cb19aef7d25fac9e987070a05bb3e6654b736a7cc4a57
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.0.0

Botnet
  • Office

C2
  • espinyskibidi-40205.portmap.host:40205

Mutex
  • CdrjrrWbtRopP1ic7E

Attributes
  • encryption_key

    P2ctPN6uGReD4W1dEypm

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client

  • subdirectory

    Microsoft

Targets

    • Target
      PDennSploit.v1.2.rar
    • Size 14.6MB
    • SHA256 d981d6d8221ccbf1501cb19aef7d25fac9e987070a05bb3e6654b736a7cc4a57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    • Downloads MZ/PE file

    • Executes dropped EXE

    • Target
      PDennSploit v1.2/lib/editor/ace/ext-spellcheck.js
    • Size 2KB
    • SHA256 318098d8dda85a7aa0859b44432f6bb6b2584bc17bec659f4b930c7cee7247f7
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-split.js
    • Size 6KB
    • SHA256 2b0c9ac356ad3e511c8bf55dac02423d280ab215e53809b43004026e1bbcf359
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-static_highlight.js
    • Size 6KB
    • SHA256 c6142c10b97e4a1b40874fb714a6d5cc3c11855a82e60922f85585531fcac11b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-statusbar.js
    • Size 1KB
    • SHA256 67ad7dfcdd1a884d5ec0ecf405ce252dcfda3882834bc9f048baa9458109ff97
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-textarea.js
    • Size 16KB
    • SHA256 10402827a803a9a63f867208d0f3daf551686a2ac7e4e800ec9ed899c3bd437c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-themelist.js
    • Size 2KB
    • SHA256 83ea5687cb2ba6491785092d9b2acd1bf9c48ca2aca5eebf6efde035166ac865
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/ext-whitespace.js
    • Size 6KB
    • SHA256 259efc69734bf5bb921aa709efbd6c4b54c8e27bfbea2c4880e62b1c8d4ca9a9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/keybinding-emacs.js
    • Size 39KB
    • SHA256 aa6c3e199f6542d5babb28ea675db7676cc83236287c4606ae361698a82e4d6a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/keybinding-sublime.js
    • Size 11KB
    • SHA256 2f53dfd085f99c05d580a2e788c6d78bf16d87ef25b44bde1c3e7475f78c65ca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/keybinding-vim.js
    • Size 214KB
    • SHA256 ca45d7afdc5519b3c42bb8d0bf5735d3d600c4876e2125151290daacbb6ca080
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/keybinding-vscode.js
    • Size 8KB
    • SHA256 f47e1734447c73aebe6785687073bd3a24504993771c4b58b75e181974254c60
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/mode-lua.js
    • Size 15KB
    • SHA256 831af7ba3d16bd2a394aebeb0098c72b310bdbc6a5277c9750eb83146b8c2e66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/abap.js
    • Size 503B
    • SHA256 9255d4d088df2630ed01ef1085c3b5284c94e2643bef33412afddafbfe17ea7b
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/abc.js
    • Size 1KB
    • SHA256 c3ddc98ad2b93380d4461c1777bacd8584055c18e59f5244693ec838f4fe152f
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/actionscript.js
    • Size 3KB
    • SHA256 03cc95c24fd8679a2407a17d028fe35cf0d890e7ff1951cda76c698d2d2af616
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/ada.js
    • Size 500B
    • SHA256 c32dcf884087ebb33622010a0cb295aa558c031d1f338dc419e9125e3dbd6e07
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/apache_conf.js
    • Size 524B
    • SHA256 23c8f97b59d0026801af74eb4f4344cdd6c2dfc28fbf0ea7f834697ce1d1eedf
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/apex.js
    • Size 503B
    • SHA256 6baa5920c72ee709334237a024720720060effd371e53a11d02ae396e836028b
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/applescript.js
    • Size 524B
    • SHA256 a7bd07909f63683c4a10d92dd1c91bdd2fe606e0e24806efc6816682adf6dc24
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/aql.js
    • Size 500B
    • SHA256 1cc8157457f21131392e79ad27aeeb9ab7708a0f4f7563f926c9a6512c395949
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/asciidoc.js
    • Size 515B
    • SHA256 427a4992cbe82670388c0e9eb4c4615f45e5a6eeb78a68e099408ac407c08ee4
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/asl.js
    • Size 512B
    • SHA256 e14ee22519ebf8a5d8ffc06130dc7b65473415df68d26ec8d826f760dc5c1d2d
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/assembly_x86.js
    • Size 527B
    • SHA256 ed89adf957ce022b0d870af58ecf59e2aab870abbd3f6c115c1187766db76491
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/autohotkey.js
    • Size 521B
    • SHA256 421832a3a4bebc1784d2d2809e22278f5a28598a728ffe06bee12d5a110c8db8
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/batchfile.js
    • Size 518B
    • SHA256 2a6503bc322c6d2583e70458dae1640ba32bb57771592e11bde30e84c5f27f48
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/bro.js
    • Size 497B
    • SHA256 d668beb9c796d0a823f2dc0071fe276e3cbf51c50042235db4feb970f9f0d805
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/c9search.js
    • Size 515B
    • SHA256 2c193d1b6380b471c6ff7ae36312b5e085bcbcb724e3588d13babed293e8f061
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/c_cpp.js
    • Size 3KB
    • SHA256 4c3a33a006fec04ba3b7641aa42a487612341e4af42d534356f55243ddffe9a4
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/cirru.js
    • Size 506B
    • SHA256 a151365c6ddf174f6ae4629e0a5d5e76436c409be9156efcb2814a7d20cfeb4a
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/clojure.js
    • Size 2KB
    • SHA256 b8f8999d1ccce45ce81ea4c34f96721635fd7fceb01429531ae49b0ebf5a7700
    • MD5 SHA1 SHA512
    Score
    3/10
    • Target
      PDennSploit v1.2/lib/editor/ace/snippets/cobol.js
    • Size 506B
    • SHA256 169cb1823568d8c5582f942df460d84fc2eb0a5a73da99dee63e12bb01f96606
    • MD5 SHA1 SHA512
    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks

static1

officevmprotectquasar
Score
10/10

behavioral1

Score
8/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10