Overview

overview

10

Static

static

1

x.ps1

windows7-x64

7

x.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    x.ps1

  • Size

    757KB

  • Sample

    241209-grbyrsvpdm

  • MD5

    e9bf208781b60d91292c6177677e27f8

  • SHA1

    364f17ba1b85e4c903157cb8a897f35fa48e73b7

  • SHA256

    66b3309146e34ae971ff0b5933d2392c9016ea8c8fef2b41b66bb11f6dd84acf

  • SHA512

    3b17fc0a33cdb568ce10a78df234ecd05331d020fdd7eb52ec22e1461df0231569ce6a6d86dd1276495bfae8f4d8bf96b42cad2434c18bb170a5f96a43ca29d7

  • SSDEEP

    12288:gcsub9WFDXHZwlfFd41W1QJzJRm2FDgM/ZR4skE8fITcH1B:gcDb9WJ+lfFd41WmzJwmDR/ZR4skE8fH

Score
10/10
quasardiscoveryexecutionspywaretrojan

Malware Config

Targets

    • Target

      x.ps1

    • Size

      757KB

    • MD5

      e9bf208781b60d91292c6177677e27f8

    • SHA1

      364f17ba1b85e4c903157cb8a897f35fa48e73b7

    • SHA256

      66b3309146e34ae971ff0b5933d2392c9016ea8c8fef2b41b66bb11f6dd84acf

    • SHA512

      3b17fc0a33cdb568ce10a78df234ecd05331d020fdd7eb52ec22e1461df0231569ce6a6d86dd1276495bfae8f4d8bf96b42cad2434c18bb170a5f96a43ca29d7

    • SSDEEP

      12288:gcsub9WFDXHZwlfFd41W1QJzJRm2FDgM/ZR4skE8fITcH1B:gcDb9WJ+lfFd41WmzJwmDR/ZR4skE8fH

    Score
    10/10
    executionquasardiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks