Resubmissions

06-11-2024 14:36

241106-ry24mstrdl 10

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241106-ry24mstrdl

  • MD5

    6fad631f98ce4dd18768a24f4c30eb89

  • SHA1

    2fb91ad5b71ffb0e5f6aaf596504e3cbdcd6e8c6

  • SHA256

    b6a9d5b847a9b36874a2b95dab1b7e3fbe0a9fa0ac0577598b0810bd31798bfb

  • SHA512

    825f45d6492fda82be6012eec9c4ddb5c67f0ec93551d17375a591f5f9fe099058ca83c707e74d736ea2b4906e3c07260296e00ac6be8994714b64f09f4818b8

  • SSDEEP

    49152:uv+I22SsaNYfdPBldt698dBcjHsC41JnKoGdl2cTHHB72eh2NT:uvz22SsaNYfdPBldt6+dBcjHsCp

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

heyhey5577-38424.portmap.host:38424

Mutex

81fe4881-d995-475f-a69c-87b3e84568e5

Attributes
  • encryption_key

    36434604456E6FAC74D069938FAF746337F3F873

  • install_name

    winupdate.exe

  • log_directory

    UpdaterInfo

  • reconnect_delay

    3000

  • startup_key

    winsysupdater

  • subdirectory

    WlNDOWS

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      6fad631f98ce4dd18768a24f4c30eb89

    • SHA1

      2fb91ad5b71ffb0e5f6aaf596504e3cbdcd6e8c6

    • SHA256

      b6a9d5b847a9b36874a2b95dab1b7e3fbe0a9fa0ac0577598b0810bd31798bfb

    • SHA512

      825f45d6492fda82be6012eec9c4ddb5c67f0ec93551d17375a591f5f9fe099058ca83c707e74d736ea2b4906e3c07260296e00ac6be8994714b64f09f4818b8

    • SSDEEP

      49152:uv+I22SsaNYfdPBldt698dBcjHsC41JnKoGdl2cTHHB72eh2NT:uvz22SsaNYfdPBldt6+dBcjHsCp

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks