Overview

overview

10

Static

static

10

fgnjxgfhfgh.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fgnjxgfhfgh.exe

  • Size

    3.1MB

  • Sample

    241106-2lrggsymbz

  • MD5

    87628637ff83eeb2588081da2c0be85d

  • SHA1

    cfe7bf61a7616b762d9c692c61690637d65d783f

  • SHA256

    85ec8cc2116f9b2dbbe9a78167088357b8b5bd42a77e9024337eac7733fa1760

  • SHA512

    14932f54eade37b745f8cfd170fc5ad1d372edee4686f62486b7adde621e938cfad697af47cbbad3a88e9891c3ddcf04d3989e7c718b8ab242eb5cffefe9b9f9

  • SSDEEP

    49152:DvyI22SsaNYfdPBldt698dBcjHa5ca95bQZk/DLoGdPTHHB72eh2NT:Dvf22SsaNYfdPBldt6+dBcjHHat

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.9:55302

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      fgnjxgfhfgh.exe

    • Size

      3.1MB

    • MD5

      87628637ff83eeb2588081da2c0be85d

    • SHA1

      cfe7bf61a7616b762d9c692c61690637d65d783f

    • SHA256

      85ec8cc2116f9b2dbbe9a78167088357b8b5bd42a77e9024337eac7733fa1760

    • SHA512

      14932f54eade37b745f8cfd170fc5ad1d372edee4686f62486b7adde621e938cfad697af47cbbad3a88e9891c3ddcf04d3989e7c718b8ab242eb5cffefe9b9f9

    • SSDEEP

      49152:DvyI22SsaNYfdPBldt698dBcjHa5ca95bQZk/DLoGdPTHHB72eh2NT:Dvf22SsaNYfdPBldt6+dBcjHHat

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks