Overview

overview

10

Static

static

3

cef6ff6123...87.exe

windows7-x64

10

cef6ff6123...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cef6ff61237797f8e596d28bfe0ae5ad62824b25ba52ae8dce67f3a4e3f59387.exe

  • Size

    4.2MB

  • Sample

    241203-pm43ra1jep

  • MD5

    fded29ae5dcb60a312880b86f918ea1f

  • SHA1

    dfa4acc16804ef47ed513c0b77ab75dd3576a8d2

  • SHA256

    cef6ff61237797f8e596d28bfe0ae5ad62824b25ba52ae8dce67f3a4e3f59387

  • SHA512

    f690eb8164eedee159f9f3d39188f0564521155e0850dcaae139da33c514aaf9ea1313264eb991f4472d9c5d2c706d33841d567d0a534e5fda4ca27f9c1b9b11

  • SSDEEP

    24576:DJwau91PHKWGydL38EqXKzr2gduRXFzP5AtTQpFX+m5fi69fffZctAv7vIjOvtXb:9mdj09Mg9wcWRVpuIRM/

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.0.2.10:4782

Mutex

5e88c20b-b195-4047-9b1c-7f8d48b72752

Attributes
  • encryption_key

    54E2D6E30589DDFD447DFA1043FAA166C85E85DA

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      cef6ff61237797f8e596d28bfe0ae5ad62824b25ba52ae8dce67f3a4e3f59387.exe

    • Size

      4.2MB

    • MD5

      fded29ae5dcb60a312880b86f918ea1f

    • SHA1

      dfa4acc16804ef47ed513c0b77ab75dd3576a8d2

    • SHA256

      cef6ff61237797f8e596d28bfe0ae5ad62824b25ba52ae8dce67f3a4e3f59387

    • SHA512

      f690eb8164eedee159f9f3d39188f0564521155e0850dcaae139da33c514aaf9ea1313264eb991f4472d9c5d2c706d33841d567d0a534e5fda4ca27f9c1b9b11

    • SSDEEP

      24576:DJwau91PHKWGydL38EqXKzr2gduRXFzP5AtTQpFX+m5fi69fffZctAv7vIjOvtXb:9mdj09Mg9wcWRVpuIRM/

    Score
    10/10
    quasaroffice04discoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks