Overview

overview

10

Static

static

1

Probemos.7z

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Probemos.7z

  • Size

    921KB

  • Sample

    241106-xc2tmswdkr

  • MD5

    2c9e9e573dce254a92c95de0f117f6b8

  • SHA1

    c846885543546114dfa980f4909e717781a98223

  • SHA256

    5a8517d098a33a7cda0ec60b91971e5a94e09b52bf8cb7a1340ed4558dcf493d

  • SHA512

    be223ae15079e58392609ac2c821999a51b949827afe8444dc2fc9d6284f112d7ab9697539b4dca6d9364e639a2424a55a03eee124652b2421873b328f449e19

  • SSDEEP

    12288:hY6PkRs2bkF6L/rBOd+kkVypeb1FQ8a8/JEBrgdVu0qVar7EUbBby/+G4o:xsNgFIbkkMw1FUHgOV5UbRy/+0

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

AdanFlores3912-54860.portmap.host:54860

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Probemos.7z

    • Size

      921KB

    • MD5

      2c9e9e573dce254a92c95de0f117f6b8

    • SHA1

      c846885543546114dfa980f4909e717781a98223

    • SHA256

      5a8517d098a33a7cda0ec60b91971e5a94e09b52bf8cb7a1340ed4558dcf493d

    • SHA512

      be223ae15079e58392609ac2c821999a51b949827afe8444dc2fc9d6284f112d7ab9697539b4dca6d9364e639a2424a55a03eee124652b2421873b328f449e19

    • SSDEEP

      12288:hY6PkRs2bkF6L/rBOd+kkVypeb1FQ8a8/JEBrgdVu0qVar7EUbBby/+G4o:xsNgFIbkkMw1FUHgOV5UbRy/+0

    Score
    10/10
    quasaroffice04discoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks