General
-
Target
6d886767f487cd0bc1ee29c899540e2ccfe6f1d3253ea629acd8d397a0a84faa
-
Size
9.3MB
-
Sample
240818-qx3s4swble
-
MD5
5a23736751d69efa3f8ddde7e1a21b50
-
SHA1
d4e164b257e3045b9def50cb8374709482b91342
-
SHA256
6d886767f487cd0bc1ee29c899540e2ccfe6f1d3253ea629acd8d397a0a84faa
-
SHA512
e10aec6a64955a104e91df59c6a29151b77ba24a818234f4350b6a8247e99dd4de58a4744ac080b9c8bea63400879f24f8eecc3ad802bfa6e41d82420d66b0a9
-
SSDEEP
196608:DStfDf00BEGl+DiBzifd4bfAbeY1dtx1SkvWcBbvX5dd38UneuendDvItO4:2l1BUDiBzil4bfADnDBt374ig4
Static task
static1
Behavioral task
behavioral1
Sample
Release/Handlers/Handler.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Release/Handlers/Handler.bat
Resource
win10v2004-20240802-en
Malware Config
Extracted
quasar
1.0.0.0
v2.2.5 | VanillaRAT
163.5.215.216:4782
cbadd9b5-ddec-4242-bf61-1d311f862dd3
-
encryption_key
1C7D50D49C8CFBD67416B7A7C9CD3F45FD94217E
-
install_name
.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
Targets
-
-
Target
Release/Handlers/Handler.bat
-
Size
12.7MB
-
MD5
e154d92aa7ecd7728940f32bb2c82cc6
-
SHA1
b004e191ae993b3deab2d77c6f99c64e5de55672
-
SHA256
37be53a96145cd6ad7557e95d85a256377af9d9e126538a4733ebde178254cc5
-
SHA512
b8b822fc4d8295a59700b7750fff7841f56ed877207e622dd7d7b0435ce737f212d5f754c95f2329b87e83c1ae796b07724276473256d8787f0f87b1871121e4
-
SSDEEP
49152:Fh5PUtdFBcAJU7Ygqef4u6NE6BGzp3OtWxgusC7QG5r0Wn9O3oGpWJtPS1P8keqj:4
-
Quasar payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Indicator Removal: Clear Windows Event Logs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Loads dropped DLL
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
1Hidden Window
1Indicator Removal
1Clear Windows Event Logs
1