Overview

overview

10

Static

static

10

9ebcb81833...18.exe

windows7-x64

10

9ebcb81833...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ebcb8183363c51b636912e7070546b0_JaffaCakes118

  • Size

    255KB

  • Sample

    240611-thbb4asfke

  • MD5

    9ebcb8183363c51b636912e7070546b0

  • SHA1

    ebbed1224074d8a643e699bbe768b836d535ce68

  • SHA256

    8cd9aff6f3cbd5ff56e9ca5437058ce36be17f4527d353ca0afa806a6f056390

  • SHA512

    691114acca292f3f53f7e84c3a30d1390588ad4fba7031fe668b3acb39ac15592a84f0ebad5023a80d3952e9b05b40539eb4d40b7ba46576a355c52467475fe2

  • SSDEEP

    3072:tK+9nWaAP9oYAKTVDmpyDcsvfedfNfkkp1nvESHnXSjb4frJS8496IC7KWXVK/k:vnjAiYAyVDNed5p14jb4TJS8EU

Score
10/10
quasaraspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

A

C2

localhost:4782

Mutex

QSR_MUTEX_xTVVhU2H7hDjv54aZ4

Attributes
  • encryption_key

    Lu3Eog5LE1n3uN0cm9cq

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      9ebcb8183363c51b636912e7070546b0_JaffaCakes118

    • Size

      255KB

    • MD5

      9ebcb8183363c51b636912e7070546b0

    • SHA1

      ebbed1224074d8a643e699bbe768b836d535ce68

    • SHA256

      8cd9aff6f3cbd5ff56e9ca5437058ce36be17f4527d353ca0afa806a6f056390

    • SHA512

      691114acca292f3f53f7e84c3a30d1390588ad4fba7031fe668b3acb39ac15592a84f0ebad5023a80d3952e9b05b40539eb4d40b7ba46576a355c52467475fe2

    • SSDEEP

      3072:tK+9nWaAP9oYAKTVDmpyDcsvfedfNfkkp1nvESHnXSjb4frJS8496IC7KWXVK/k:vnjAiYAyVDNed5p14jb4TJS8EU

    Score
    10/10
    quasaraspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks