Overview

overview

10

Static

static

10

UnionFreeBeta.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UnionFreeBeta.exe

  • Size

    3.1MB

  • Sample

    241105-z8bcnszbmj

  • MD5

    aede48915ee20fd0a295c890cd5d6358

  • SHA1

    f2a1b241364307a4aa6392644f8af91f5fe9e481

  • SHA256

    a87bae829ed2396145c0fe182249e6f057a06b230c03165be042c1902167d40d

  • SHA512

    cb52842b3ab23afed321fdfa18951354bd345a91d37f8a3d999d6ed4252c24448892863a5fe2f97052cac2d8beb3aed245ffdda18c27f6233bebf18de9f81288

  • SSDEEP

    49152:PvulL26AaNeWgPhlmVqvMQ7XSKflRJ6vbR3LoGdyTHHB72eh2NT:PveL26AaNeWgPhlmVqkQ7XSKflRJ6B

Score
10/10
quasarunionfreemenuspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

UnionFreeMenu

C2

wydidk-54735.portmap.host:54735

Mutex

a66c87d1-9ff9-41cd-b89a-e4abdaec6149

Attributes
  • encryption_key

    02F7E65772D519DFA0CB988D3EBC116D7AF084EA

  • install_name

    UnionSZettings.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    UnionMenuLoader

  • subdirectory

    SubDir

Targets

    • Target

      UnionFreeBeta.exe

    • Size

      3.1MB

    • MD5

      aede48915ee20fd0a295c890cd5d6358

    • SHA1

      f2a1b241364307a4aa6392644f8af91f5fe9e481

    • SHA256

      a87bae829ed2396145c0fe182249e6f057a06b230c03165be042c1902167d40d

    • SHA512

      cb52842b3ab23afed321fdfa18951354bd345a91d37f8a3d999d6ed4252c24448892863a5fe2f97052cac2d8beb3aed245ffdda18c27f6233bebf18de9f81288

    • SSDEEP

      49152:PvulL26AaNeWgPhlmVqvMQ7XSKflRJ6vbR3LoGdyTHHB72eh2NT:PveL26AaNeWgPhlmVqkQ7XSKflRJ6B

    Score
    10/10
    quasarunionfreemenuspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks