General

  • Target

    Fortnite Cheat copy.exe

  • Size

    3.1MB

  • Sample

    240722-x22vyatgnl

  • MD5

    1598308742408e238ceb159f3d3d22a2

  • SHA1

    8d48e39ac338e2cc2396e34be9351b2afdbcbf18

  • SHA256

    fb9a47023dd34f1186c923861cfaa7a6d909fa946cb6da70df42bea9f9dfbd79

  • SHA512

    717b4b26c8e6811f91ae7c7dc98cca9e5f428266dfb7beeca8a7dbca75de7e087df075b35c7776d35ca6b4d0d8f51a24a9e5ca6fa1f01fdf99df47ec4c047d52

  • SSDEEP

    49152:KvyI22SsaNYfdPBldt698dBcjHlhRJ6abR3LoGdKTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHlhRJ60

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.40.128:4782

Mutex

dc68b59b-d7fa-4156-b1ee-e1f2c1185105

Attributes
  • encryption_key

    9C9B7D2A685B9D72FEB2BFE3DFE7DF302C04421B

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Fortnite Cheat copy.exe

    • Size

      3.1MB

    • MD5

      1598308742408e238ceb159f3d3d22a2

    • SHA1

      8d48e39ac338e2cc2396e34be9351b2afdbcbf18

    • SHA256

      fb9a47023dd34f1186c923861cfaa7a6d909fa946cb6da70df42bea9f9dfbd79

    • SHA512

      717b4b26c8e6811f91ae7c7dc98cca9e5f428266dfb7beeca8a7dbca75de7e087df075b35c7776d35ca6b4d0d8f51a24a9e5ca6fa1f01fdf99df47ec4c047d52

    • SSDEEP

      49152:KvyI22SsaNYfdPBldt698dBcjHlhRJ6abR3LoGdKTHHB72eh2NT:Kvf22SsaNYfdPBldt6+dBcjHlhRJ60

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks