Overview

overview

10

Static

static

10

d8e1f8133b...2c.exe

windows7-x64

10

d8e1f8133b...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

  • Size

    502KB

  • Sample

    240612-fkkrna1erq

  • MD5

    22dcffb27d97e5307563e371b2def462

  • SHA1

    3321cd46304f11dd4dc31a83b61a89d85ebfc548

  • SHA256

    d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

  • SHA512

    abfbb8bae85508b36792d49a296a515f5827e95207a8eb075953b0a3cc95cdf7eb2e8c32565bc06b41d3c4e2e02fbbec45c7f53a5df246b18719cb272c74ab43

  • SSDEEP

    6144:dTEgdc0YtXAGbgiIN2RSBNZicdz7x3JXV6vjTcEDFb8F9tCUljY/10cTR3+:dTEgdfYBbgWcpaTKxjY/Wcd+

Score
10/10
quasaroffice05spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office05

C2

38.180.9.93:4782

38.180.9.93:4783
Mutex

32672773-f3f5-4ec0-837a-7adbf29ae46f

Attributes
  • encryption_key

    C9BC046B617DD0F608706B9640C8D97C327969FB

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    esnt Startup

  • subdirectory

    SubDir

Targets

    • Target

      d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

    • Size

      502KB

    • MD5

      22dcffb27d97e5307563e371b2def462

    • SHA1

      3321cd46304f11dd4dc31a83b61a89d85ebfc548

    • SHA256

      d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

    • SHA512

      abfbb8bae85508b36792d49a296a515f5827e95207a8eb075953b0a3cc95cdf7eb2e8c32565bc06b41d3c4e2e02fbbec45c7f53a5df246b18719cb272c74ab43

    • SSDEEP

      6144:dTEgdc0YtXAGbgiIN2RSBNZicdz7x3JXV6vjTcEDFb8F9tCUljY/10cTR3+:dTEgdfYBbgWcpaTKxjY/Wcd+

    Score
    10/10
    quasaroffice05spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables containing common artifacts observed in infostealers

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks