Overview

overview

10

Static

static

10

Holyskbiidid.exe

windows7-x64

10

Holyskbiidid.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Holyskbiidid.exe

  • Size

    3.1MB

  • Sample

    240617-3n9lhsyfrc

  • MD5

    d0212fe437969d03c652387b019b750f

  • SHA1

    e5b9052a98450575e92dec41b8560492ecf61838

  • SHA256

    c4af2eb6696cbbeef196266da22b17a6ea46ded86cd271fa6422e77d1f6f33d1

  • SHA512

    af7e2330b0107ad9a8d21a4974cf577258474378cccfa0ca269679e34b802a1e4c104de10e9e4469bc2c92584a0b646e5fe3393387655f1b1ade02f271d483a2

  • SSDEEP

    49152:qvWI22SsaNYfdPBldt698dBcjHlhOEEfsLk/HYXoGd7THHB72eh2NT:qv722SsaNYfdPBldt6+dBcjHlhOHg

Score
10/10
quasareyewalledspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Eyewalled

C2

147.185.221.18:18043

147.185.221.18:1358
Mutex

0ec4c1af-30af-44b2-ab2f-6813ea42dd9d

Attributes
  • encryption_key

    DF93BFF0E78CC9BB874112E9F60DEDC5B7B04CB5

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3001

  • startup_key

    Github.git

  • subdirectory

    Management

Targets

    • Target

      Holyskbiidid.exe

    • Size

      3.1MB

    • MD5

      d0212fe437969d03c652387b019b750f

    • SHA1

      e5b9052a98450575e92dec41b8560492ecf61838

    • SHA256

      c4af2eb6696cbbeef196266da22b17a6ea46ded86cd271fa6422e77d1f6f33d1

    • SHA512

      af7e2330b0107ad9a8d21a4974cf577258474378cccfa0ca269679e34b802a1e4c104de10e9e4469bc2c92584a0b646e5fe3393387655f1b1ade02f271d483a2

    • SSDEEP

      49152:qvWI22SsaNYfdPBldt698dBcjHlhOEEfsLk/HYXoGd7THHB72eh2NT:qv722SsaNYfdPBldt6+dBcjHlhOHg

    Score
    10/10
    quasareyewalledspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks