Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241130-wv22pa1jbt

  • MD5

    20f05826273f12162fa4c07fd0c522ab

  • SHA1

    eb45020a2a4a44128aa5805b34801ad4ae45cdc0

  • SHA256

    7f0fce9d1d75bff354d35566d4a0eedc0ee9104633fd859b3566cf9bfa2a711b

  • SHA512

    25c567a345f3fbcf0e18003d1d53cb34f3e7a7c37c628f0f4b2093a04b78c5fec994032e37b1bc1358bd0ba8beff221458e2ff0cdbe431560dfb2d60aac0c636

  • SSDEEP

    98304:bvf22SsaNYfdPBldt6+dBcjHNbRJ6k1A:TQ7jL9

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.3:4782

Mutex

6c1cabdf-4141-46d8-99b5-498dc096c6c6

Attributes
  • encryption_key

    A2D3322556CF1157C720ECB23F81C201C021107D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SecurityHealthSystray

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      20f05826273f12162fa4c07fd0c522ab

    • SHA1

      eb45020a2a4a44128aa5805b34801ad4ae45cdc0

    • SHA256

      7f0fce9d1d75bff354d35566d4a0eedc0ee9104633fd859b3566cf9bfa2a711b

    • SHA512

      25c567a345f3fbcf0e18003d1d53cb34f3e7a7c37c628f0f4b2093a04b78c5fec994032e37b1bc1358bd0ba8beff221458e2ff0cdbe431560dfb2d60aac0c636

    • SSDEEP

      98304:bvf22SsaNYfdPBldt6+dBcjHNbRJ6k1A:TQ7jL9

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks