Overview

overview

10

Static

static

10

Neverlose-...in.zip

windows10-1703-x64

10

Neverlose-...er.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Neverlose-Loader-main.zip

  • Size

    227KB

  • Sample

    241019-byqsls1dnj

  • MD5

    46de2e1c007d56e22e8abc7885af8bbe

  • SHA1

    0f780f64ea2c22302f8e08a527d5a04fd429aba5

  • SHA256

    e20f97d57623732bc8c216d8fb182f37b09934728ffa833c12a98a0c0c0957d5

  • SHA512

    3bb1a51eea02dbf8d4e7c8fa88e6dae2efedb8d614d64c998c7508e13b3063b7fa7ae48f60196bf9a40045511e17e424ab1b7a30bcef6898acda657ea9c595cf

  • SSDEEP

    6144:B19gu5MiTpOZxQrT56mzfV5bFW1cSguff:BwMJTFo+V5bu1guX

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.31.99:4782

2001:4bc9:1f98:a4e::676:4782

255.255.255.0:4782

fe80::cabf:4cff:fe84:9572%17:4782
Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes
  • encryption_key

    A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9

  • install_name

    Neverlose Loader.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Targets

    • Target

      Neverlose-Loader-main.zip

    • Size

      227KB

    • MD5

      46de2e1c007d56e22e8abc7885af8bbe

    • SHA1

      0f780f64ea2c22302f8e08a527d5a04fd429aba5

    • SHA256

      e20f97d57623732bc8c216d8fb182f37b09934728ffa833c12a98a0c0c0957d5

    • SHA512

      3bb1a51eea02dbf8d4e7c8fa88e6dae2efedb8d614d64c998c7508e13b3063b7fa7ae48f60196bf9a40045511e17e424ab1b7a30bcef6898acda657ea9c595cf

    • SSDEEP

      6144:B19gu5MiTpOZxQrT56mzfV5bFW1cSguff:BwMJTFo+V5bu1guX

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

    • Target

      Neverlose-Loader-main/Neverlose Loader.exe

    • Size

      502KB

    • MD5

      f5b150d54a0ba2d902974cbfd6249c56

    • SHA1

      92e28c3d9ff4392eed379d816dda6939113830bd

    • SHA256

      1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

    • SHA512

      57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

    • SSDEEP

      12288:gTEgdfYv/izUrFL4dywjapf/WI2TI/uqcdj:1Uwwq+ywjapHWbEcdj

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks