General

  • Target

    sample.exe

  • Size

    3.1MB

  • Sample

    240722-xdl5ks1hkf

  • MD5

    42a4b2ddf267c41ad37f9d278b9cb99d

  • SHA1

    8f78d2dfc7c33e26bd9ab86bb3e907b243ae43ba

  • SHA256

    e2ef548c1a8a1624a0bf37ab59939bd62755bbd0d43a0419d86564b53383fcd7

  • SHA512

    299981b520c93991bf5d0f76e5ad5e293ec92eb7f89f42e4296984994d7040df0d609de38f7bd1b3a07ec711c8f3150a4080daacec74bcbcc7516e750fbb3933

  • SSDEEP

    12288:NB08b8OrtRMdvlOVIkVovMdtL0CFnlzT83xKc:b080viI0ovMdtL0CFnlzTKKc

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

45.66.231.154:4782

Mutex

4304b988-116c-4522-ab83-7f9ad875f60f

Attributes
  • encryption_key

    A6B8B9B9B02FC86103A59CE003D7B3B45DAF8550

  • install_name

    svchost.exe

  • log_directory

    svchost

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    svchost

Targets

    • Target

      sample.exe

    • Size

      3.1MB

    • MD5

      42a4b2ddf267c41ad37f9d278b9cb99d

    • SHA1

      8f78d2dfc7c33e26bd9ab86bb3e907b243ae43ba

    • SHA256

      e2ef548c1a8a1624a0bf37ab59939bd62755bbd0d43a0419d86564b53383fcd7

    • SHA512

      299981b520c93991bf5d0f76e5ad5e293ec92eb7f89f42e4296984994d7040df0d609de38f7bd1b3a07ec711c8f3150a4080daacec74bcbcc7516e750fbb3933

    • SSDEEP

      12288:NB08b8OrtRMdvlOVIkVovMdtL0CFnlzT83xKc:b080viI0ovMdtL0CFnlzTKKc

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks