Overview

overview

10

Static

static

3

2e72d847aa...38.exe

windows7-x64

10

2e72d847aa...38.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e72d847aa6ea6680c769628c4ea4938.exe

  • Size

    3.6MB

  • Sample

    241109-g9z4baslhm

  • MD5

    2e72d847aa6ea6680c769628c4ea4938

  • SHA1

    5f4a1cacb1c414787a51444a06c1081a2e6eb469

  • SHA256

    a1ba76a8c187d43080d95acfb939a54d1b1c83546bbb4547990bbfcafd88c307

  • SHA512

    6c9797f4c4fdf0e36cc4efbb564f46617b5e83fc0ea44c4e1932e870183a577fedfd07f0376531841084892e1499cc870524c3f0aa707a61f187a779330629c1

  • SSDEEP

    98304:Kh6wZR7VXWhBwoGQ/9KHjlWsO9ndIdYYWGyF:26iOwfS9KpWNa4

Score
10/10
quasarjekwudiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

JEKWU

C2

Zyg.ydns.eu:5829

Opy.ydns.eu:5829
Mutex

9c58b2ba-07eb-415a-b48b-21bbb68d32285e

Attributes
  • encryption_key

    C5B555A83D127A9553D4FB1FCECB35CE8E91A447

  • install_name

    outlooks.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Outlooks

  • subdirectory

    WindowsUpdates

Targets

    • Target

      2e72d847aa6ea6680c769628c4ea4938.exe

    • Size

      3.6MB

    • MD5

      2e72d847aa6ea6680c769628c4ea4938

    • SHA1

      5f4a1cacb1c414787a51444a06c1081a2e6eb469

    • SHA256

      a1ba76a8c187d43080d95acfb939a54d1b1c83546bbb4547990bbfcafd88c307

    • SHA512

      6c9797f4c4fdf0e36cc4efbb564f46617b5e83fc0ea44c4e1932e870183a577fedfd07f0376531841084892e1499cc870524c3f0aa707a61f187a779330629c1

    • SSDEEP

      98304:Kh6wZR7VXWhBwoGQ/9KHjlWsO9ndIdYYWGyF:26iOwfS9KpWNa4

    Score
    10/10
    quasarjekwudiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks