General

  • Target

    robloxtockenstealer.exe

  • Size

    3.2MB

  • Sample

    241116-x77cls1pcy

  • MD5

    e7c12a69820f13031fbc2a3bfe6cff2b

  • SHA1

    8959411ec12367b73ceb4971eb0bed6bf8773a35

  • SHA256

    e37f5e8a493f127516a17a57e47bb891d665f8a0aed15871c8551c94b38398e4

  • SHA512

    25a4a9124d386ece9a3c044d7bc0d03281b901ec8d6f96b840d51f7ec0702da9bf16f07fdda98b0a15409ca604629b3220cbcdc9cff24629eeeb38462282ecde

  • SSDEEP

    98304:DFqg2FttFGwikj7yVEErTRHX0tsEwwjBWOWeYMWmWjn2:DFqgibV7yVDrFHEtsEwwIFM3

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.56.1:4782

Mutex

47f0198a-a3d8-4194-852e-7997def309cf

Attributes
  • encryption_key

    C420C6BA5A73AFC71829A3D6D18F010F1FDAE794

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      robloxtockenstealer.exe

    • Size

      3.2MB

    • MD5

      e7c12a69820f13031fbc2a3bfe6cff2b

    • SHA1

      8959411ec12367b73ceb4971eb0bed6bf8773a35

    • SHA256

      e37f5e8a493f127516a17a57e47bb891d665f8a0aed15871c8551c94b38398e4

    • SHA512

      25a4a9124d386ece9a3c044d7bc0d03281b901ec8d6f96b840d51f7ec0702da9bf16f07fdda98b0a15409ca604629b3220cbcdc9cff24629eeeb38462282ecde

    • SSDEEP

      98304:DFqg2FttFGwikj7yVEErTRHX0tsEwwjBWOWeYMWmWjn2:DFqgibV7yVDrFHEtsEwwIFM3

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks