Overview

overview

10

Static

static

10

EYEEEE.exe

windows7-x64

10

EYEEEE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EYEEEE.exe

  • Size

    3.1MB

  • Sample

    240618-hn9w3a1hnd

  • MD5

    e4ac17b0bd58ea8210b61bd5456eb924

  • SHA1

    bcb69dfe1502df9fc79eecf720ce9b4637159500

  • SHA256

    e060166f62c27e84c151286b8c29ae0507f20e489f56369a8f84f7d6d94e6fa8

  • SHA512

    45a0ebda7a22437fe4fc33103d86eb96b2fcde3fae5f90e52ab2bdaca728df008782e6ca5b3d8d133e6481563f4d48d88a82c351f8dd1114b2586cd85c85430b

  • SSDEEP

    49152:tsS4wA2Glaq5+RPelPedKukZ2UrDluNw5tu+k/lyoGdGTHHB72eh2NT:tsWA2Glaq5+RPelPed3kZ2UrDkNQ

Score
10/10
quasareyewalledspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Eyewalled

C2

147.185.221.18:18043

147.185.221.18:1358
Mutex

a3d2b6d9-f229-4f07-a990-dabdf6a10cde

Attributes
  • encryption_key

    B3AE4475AF1A6844B3AC5E40D6C3D2D1114C7DFA

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3001

  • startup_key

    Github.git

  • subdirectory

    Management

Targets

    • Target

      EYEEEE.exe

    • Size

      3.1MB

    • MD5

      e4ac17b0bd58ea8210b61bd5456eb924

    • SHA1

      bcb69dfe1502df9fc79eecf720ce9b4637159500

    • SHA256

      e060166f62c27e84c151286b8c29ae0507f20e489f56369a8f84f7d6d94e6fa8

    • SHA512

      45a0ebda7a22437fe4fc33103d86eb96b2fcde3fae5f90e52ab2bdaca728df008782e6ca5b3d8d133e6481563f4d48d88a82c351f8dd1114b2586cd85c85430b

    • SSDEEP

      49152:tsS4wA2Glaq5+RPelPedKukZ2UrDluNw5tu+k/lyoGdGTHHB72eh2NT:tsWA2Glaq5+RPelPed3kZ2UrDkNQ

    Score
    10/10
    quasareyewalledspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks