Overview

overview

10

Static

static

10

7402de5390...31.exe

windows7-x64

10

7402de5390...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7402de539089b009b82d0d643d7b78234c792407d18ab99fd68de78493dede31.exe

  • Size

    3.1MB

  • Sample

    240612-xycrmszgpm

  • MD5

    cded3e935b1541f8e930f07e8829f551

  • SHA1

    e7fc4bc9525e5b04b6877ed362ecfcec83fa2d8c

  • SHA256

    7402de539089b009b82d0d643d7b78234c792407d18ab99fd68de78493dede31

  • SHA512

    dd979da2ee725fcdb49a094617fd8e41a283f3dbd809fd939c009ff5609a29e0042be7c6d92cf30c1219b0a9d56ee406a865d1e32ef5b56fdc1f3580bce83d05

  • SSDEEP

    49152:rvSI22SsaNYfdPBldt698dBcjHPCbm9mz6yoGdBTHHB72eh2NT:rv/22SsaNYfdPBldt6+dBcjHabmw

Score
10/10
quasarvcruntime140spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

vcruntime140

C2

192.168.178.57:4782

Mutex

b358e7e9-0f3b-4d47-8e56-2ccc087705cb

Attributes
  • encryption_key

    B1736A0DDBD7AF739BB0E3FE61B51CEFF7F8DDB3

  • install_name

    vcruntime140.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    vcruntime140

  • subdirectory

    SubDir

Targets

    • Target

      7402de539089b009b82d0d643d7b78234c792407d18ab99fd68de78493dede31.exe

    • Size

      3.1MB

    • MD5

      cded3e935b1541f8e930f07e8829f551

    • SHA1

      e7fc4bc9525e5b04b6877ed362ecfcec83fa2d8c

    • SHA256

      7402de539089b009b82d0d643d7b78234c792407d18ab99fd68de78493dede31

    • SHA512

      dd979da2ee725fcdb49a094617fd8e41a283f3dbd809fd939c009ff5609a29e0042be7c6d92cf30c1219b0a9d56ee406a865d1e32ef5b56fdc1f3580bce83d05

    • SSDEEP

      49152:rvSI22SsaNYfdPBldt698dBcjHPCbm9mz6yoGdBTHHB72eh2NT:rv/22SsaNYfdPBldt6+dBcjHabmw

    Score
    10/10
    quasarvcruntime140spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks