General

  • Target

    7ed40bf99a35a45a00db1ad472ffbcce1758f5b92491378b89f0559170d8f178

  • Size

    3.1MB

  • Sample

    241103-avd4zazcmh

  • MD5

    878be87c49bd5b989fbf5464d225430a

  • SHA1

    40149c47a14f317807fa3926318c6c975bba92d8

  • SHA256

    7ed40bf99a35a45a00db1ad472ffbcce1758f5b92491378b89f0559170d8f178

  • SHA512

    9756cb149de4fbc267b82dc0a6dc0fa1724091ce04676568c1874896d4876c79533f234b74566b676edd0a3fd1a609c9e8b9530ce60bb04ce1766befadf365fe

  • SSDEEP

    49152:iv/t62XlaSFNWPjljiFa2RoUYIg5vZEfoEkCqMZo8d1THHB72eh2NT:ivV62XlaSFNWPjljiFXRoUYIg5v30

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

havucmarul.duckdns.org:1604

Mutex

5caac049-af48-4152-a892-2f06b763f213

Attributes
  • encryption_key

    B161C821508495BDAF45580C87E8251AF93A155C

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Services

  • subdirectory

    Windows

Targets

    • Target

      7ed40bf99a35a45a00db1ad472ffbcce1758f5b92491378b89f0559170d8f178

    • Size

      3.1MB

    • MD5

      878be87c49bd5b989fbf5464d225430a

    • SHA1

      40149c47a14f317807fa3926318c6c975bba92d8

    • SHA256

      7ed40bf99a35a45a00db1ad472ffbcce1758f5b92491378b89f0559170d8f178

    • SHA512

      9756cb149de4fbc267b82dc0a6dc0fa1724091ce04676568c1874896d4876c79533f234b74566b676edd0a3fd1a609c9e8b9530ce60bb04ce1766befadf365fe

    • SSDEEP

      49152:iv/t62XlaSFNWPjljiFa2RoUYIg5vZEfoEkCqMZo8d1THHB72eh2NT:ivV62XlaSFNWPjljiFXRoUYIg5v30

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks