Overview

overview

10

Static

static

1

SCV.cmd

windows7-x64

3

SCV.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SCV.cmd

  • Size

    537KB

  • Sample

    241019-ldlm9sydnd

  • MD5

    d20bf8dba792e2edc3e0eb7e5c30b32b

  • SHA1

    7094e6e59004962f3d3161aa3016ecfcf2b3a64f

  • SHA256

    1f788a79d0a95bd4957d5a9c3314a80aaf9acdd3bccaff916c4483a8c28a0485

  • SHA512

    c68d6aac5303c5d1b7ca42c310fa21fa62f0486a2d95bbfa7b0485969634b3fd9447a5cc79f6086954022080c91777f9acb40c3c2718b09d2dac75821c816a0f

  • SSDEEP

    12288:100ynYtHxuu7eaSvaoBTiFrrdkrw1vH5FiaPQdgEMlB:10KtR3lehBAr/1vian1B

Score
10/10
quasaroffice04defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

walkout.ddnsgeek.com:8080

Mutex

27391f85-a482-471a-b2cd-1f8ab5bde32e

Attributes
  • encryption_key

    6469F8C5BA9A2CFDCF4A3F1651D1E92DBEA41117

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      SCV.cmd

    • Size

      537KB

    • MD5

      d20bf8dba792e2edc3e0eb7e5c30b32b

    • SHA1

      7094e6e59004962f3d3161aa3016ecfcf2b3a64f

    • SHA256

      1f788a79d0a95bd4957d5a9c3314a80aaf9acdd3bccaff916c4483a8c28a0485

    • SHA512

      c68d6aac5303c5d1b7ca42c310fa21fa62f0486a2d95bbfa7b0485969634b3fd9447a5cc79f6086954022080c91777f9acb40c3c2718b09d2dac75821c816a0f

    • SSDEEP

      12288:100ynYtHxuu7eaSvaoBTiFrrdkrw1vH5FiaPQdgEMlB:10KtR3lehBAr/1vian1B

    Score
    10/10
    discoveryquasaroffice04defense_evasionexecutionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks