Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.2MB

  • Sample

    241103-vvclcszfkn

  • MD5

    986dc7301d3af14a13e54ee6b3963451

  • SHA1

    4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10

  • SHA256

    06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

  • SHA512

    60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2

  • SSDEEP

    49152:mv+lL26AaNeWgPhlmVqvMQ7XSK7K63Lar/LoGdlTHHB72eh2NTS:mvuL26AaNeWgPhlmVqkQ7XSKT3Ub

Score
10/10
quasart254spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

t254

C2

t2558628-45777.portmap.host:45777

Mutex

932c65d6-da03-4072-adb9-2376e00c0a8e

Attributes
  • encryption_key

    236980CA68F0687D520534421E23683400294B98

  • install_name

    Client.exe

  • log_directory

    Windows_Logs

  • reconnect_delay

    3000

  • startup_key

    Windows defender startup client

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.2MB

    • MD5

      986dc7301d3af14a13e54ee6b3963451

    • SHA1

      4b110fb4248b17b92aa3b3010bc31bb0bd4d1b10

    • SHA256

      06c4c62665a3434d66fae0cbaebdb2a5f6905bba8ccc333205059ea13e99b135

    • SHA512

      60f454f655c69d047f901eb4abfe8667e98176ba4c51bc4ab9389c714a610d0c7c2b1d2fe80ed7e4db86e4230e2e5de8efc899647788bb5e3a101e762d6281d2

    • SSDEEP

      49152:mv+lL26AaNeWgPhlmVqvMQ7XSK7K63Lar/LoGdlTHHB72eh2NTS:mvuL26AaNeWgPhlmVqkQ7XSKT3Ub

    Score
    10/10
    quasart254spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks