General

  • Target

    1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe

  • Size

    916KB

  • Sample

    241031-1pw1psslaw

  • MD5

    6d48da1b1beffb52e09d892ff7f460c2

  • SHA1

    db0c7b45471c64dc695c98a5c61a1d3b0b1c5f41

  • SHA256

    cc2cfdb23db8b97c610105eaf704dc18e694b3df11f4a13f7187152955415fdc

  • SHA512

    864c83717d0e637dc624fe5b1d30354bb1212226e179eb52143da02b73a664ed805d68600f9370468b93fc1ad4b0c3d1682bdb2ca38d35a47cecd913d34b5228

  • SSDEEP

    24576:tmkdueXjq0OQKc2YSEegpQRDLusJLK1lkioLP:IkdueXjq0OQKc2YSEegpshk1lk

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Queda ツ

C2

45.61.174.20:5552

Mutex

ZltvfUGAo7zsf3naNu

Attributes
  • encryption_key

    EDWqFemxb3ZTD9Ymr9np

  • install_name

    Venom.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Targets

    • Target

      1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe

    • Size

      916KB

    • MD5

      6d48da1b1beffb52e09d892ff7f460c2

    • SHA1

      db0c7b45471c64dc695c98a5c61a1d3b0b1c5f41

    • SHA256

      cc2cfdb23db8b97c610105eaf704dc18e694b3df11f4a13f7187152955415fdc

    • SHA512

      864c83717d0e637dc624fe5b1d30354bb1212226e179eb52143da02b73a664ed805d68600f9370468b93fc1ad4b0c3d1682bdb2ca38d35a47cecd913d34b5228

    • SSDEEP

      24576:tmkdueXjq0OQKc2YSEegpQRDLusJLK1lkioLP:IkdueXjq0OQKc2YSEegpshk1lk

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks