Overview

overview

10

Static

static

1

-.bat.fud.bat

windows10-2004-x64

10

Resubmissions

15/08/2024, 03:40

240815-d775csxgll10

15/08/2024, 03:32

240815-d3lesssdrc10

15/08/2024, 03:29

240815-d1z56ssdlg10

Sharing

Copy URL Twitter E-mail

General

  • Target
    -.bat.fud.bat
  • Size 8KB
  • Sample240815-d3lesssdrc
  • SHA256 48e6235e3a791da0aab3b73326c5bb7ce861fe251bb16074cdf8530b2d9974b9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasar%payload%evasionexecutionpersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • %PAYLOAD%

C2

  • 1.1.1.1:1

  • 1.1.1.1:2

  • 1.1.1.1:3

  • 1.1.1.1:5

  • 1.1.1.1:6

  • 1.1.1.1:7

  • 1.1.1.1:8

  • 1.1.1.1:9

  • 1.1.1.1:11

  • 1.1.1.1:13

  • 1.1.1.1:15

  • 1.1.1.1:16

  • 1.1.1.1:18

  • 1.1.1.1:19

  • 1.1.1.1:20

  • 1.1.1.1:21

  • 1.1.1.1:22

  • 1.1.1.1:24

  • 1.1.1.1:25

  • 1.1.1.1:26

Mutex

  • 52c99c60-3e66-4500-be6c-895593eba497

Attributes
  • encryption_key

    070CDBCBB8132B62B93E1CB06630D9221F0FFA4A

  • install_name

    UnderControl.exe

  • log_directory

    Logs

  • reconnect_delay

    2000

  • startup_key

    uno

  • subdirectory

    Microsoft

Targets

    • Target
      -.bat.fud.bat
    • Size 8KB
    • SHA256 48e6235e3a791da0aab3b73326c5bb7ce861fe251bb16074cdf8530b2d9974b9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasar%payload%evasionexecutionpersistencespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • UAC bypass

      evasiontrojan

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks