Overview

overview

10

Static

static

1

1.cmd

windows11-21h2-x64

10

Resubmissions

15/10/2024, 00:37

241015-aysrjaydjm10

15/10/2024, 00:29

241015-asyqlathmd10

Sharing

Copy URL Twitter E-mail

General

  • Target
    1.cmd
  • Size 1.9MB
  • Sample241015-asyqlathmd
  • SHA256 13744b282a3927a53d5ced963a61604c98de1e3f4718e1cdae87ddd1d8de14fa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
quasar2.1office04defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 45.200.148.197:8080

Mutex

  • b24e0ed5-7881-48ee-84be-d87223f56093

Attributes
  • encryption_key

    561A2408C473BBAB7B3AD5B4005F5481E98E07AC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • 2.1

C2

  • microsoft-visualstudiocode.com:7000

Mutex

  • 1a5cb0dc-90f1-4f16-bfb6-6d70d1283383

Attributes
  • encryption_key

    608C2EF7FA3C5E6905B737821BA5F1BF71A72757

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target
      1.cmd
    • Size 1.9MB
    • SHA256 13744b282a3927a53d5ced963a61604c98de1e3f4718e1cdae87ddd1d8de14fa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasar2.1office04defense_evasiondiscoveryexecutionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks