Overview

overview

10

Static

static

5

E709905AC5...48.exe

windows7-x64

10

E709905AC5...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    E709905AC50A6290AEDA38C57E7F0048.exe

  • Size

    3.6MB

  • Sample

    241208-r1fy7a1ner

  • MD5

    e709905ac50a6290aeda38c57e7f0048

  • SHA1

    2d8760824802df5548a5e5d10ebec8ebd3851787

  • SHA256

    080ac006965a05b5bf6acab5ac6cb8cb7f5b6035883e723b5f3f845e54d90f4c

  • SHA512

    f55d5dd13ae515bb315d982e65ab1db378119957a8cc028b95b441a967770ebb5555dd61c30f51037d45560dc3091235196ffb191daee1620e5ba42d7cd5e353

  • SSDEEP

    98304:ezdmPt6BByvuntOoqGYm8wBnPyYEKplZiD5zbjL:ezwkjyGZjBnPLxZiD5bL

Score
10/10
quasarplmsodiscoveryspywaretrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Plmso

C2

110.42.3.134:4782

Mutex

41ace1c3-9f4e-4d35-93fb-096ede244c3e

Attributes
  • encryption_key

    980DB384AAAF5B8591D5B450BFA39547F61611DC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      E709905AC50A6290AEDA38C57E7F0048.exe

    • Size

      3.6MB

    • MD5

      e709905ac50a6290aeda38c57e7f0048

    • SHA1

      2d8760824802df5548a5e5d10ebec8ebd3851787

    • SHA256

      080ac006965a05b5bf6acab5ac6cb8cb7f5b6035883e723b5f3f845e54d90f4c

    • SHA512

      f55d5dd13ae515bb315d982e65ab1db378119957a8cc028b95b441a967770ebb5555dd61c30f51037d45560dc3091235196ffb191daee1620e5ba42d7cd5e353

    • SSDEEP

      98304:ezdmPt6BByvuntOoqGYm8wBnPyYEKplZiD5zbjL:ezwkjyGZjBnPLxZiD5bL

    Score
    10/10
    quasarplmsodiscoveryspywaretrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks