Overview

overview

10

Static

static

10

hrar.exe

windows7-x64

10

hrar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hrar.exe

  • Size

    3.1MB

  • Sample

    241207-djgmhaykhn

  • MD5

    b6ff996e501652ecd561639bcf8c7b65

  • SHA1

    d59eb31de4eb86fd1eb395f4e1c7fc52082c2fe6

  • SHA256

    d4e8227cf61346d7264be4f1f184898cdf84c465e622e9683993d3dcf33c4945

  • SHA512

    040ef39bc0206eccccc1b1a4af8cc46f64ed480333893ea4f5c55701ea50ca34d7c64acf7dcc08fde119cc636f9c2842715cb145b71054bccc8c42ec5fca545d

  • SSDEEP

    49152:PvelL26AaNeWgPhlmVqvMQ7XSKcORJ6abR3LoGdl3THHB72eh2NT:PvOL26AaNeWgPhlmVqkQ7XSKcORJ60V

Score
10/10
quasarroarspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roar

C2

fojeweb571-45302.portmap.host:45302

Mutex

55e529e2-c08e-4693-b5fc-9b2c7f622871

Attributes
  • encryption_key

    B42CE86AEBA4D8818352F4D811EA7BBB472E229A

  • install_name

    windows defender.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    discord

  • subdirectory

    SubDir

Targets

    • Target

      hrar.exe

    • Size

      3.1MB

    • MD5

      b6ff996e501652ecd561639bcf8c7b65

    • SHA1

      d59eb31de4eb86fd1eb395f4e1c7fc52082c2fe6

    • SHA256

      d4e8227cf61346d7264be4f1f184898cdf84c465e622e9683993d3dcf33c4945

    • SHA512

      040ef39bc0206eccccc1b1a4af8cc46f64ed480333893ea4f5c55701ea50ca34d7c64acf7dcc08fde119cc636f9c2842715cb145b71054bccc8c42ec5fca545d

    • SSDEEP

      49152:PvelL26AaNeWgPhlmVqvMQ7XSKcORJ6abR3LoGdl3THHB72eh2NT:PvOL26AaNeWgPhlmVqkQ7XSKcORJ60V

    Score
    10/10
    quasarroarspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks