Overview

overview

10

Static

static

10

rararararararaaar.exe

windows10-2004-x64

10

rararararararaaar.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rararararararaaar.exe

  • Size

    3.1MB

  • Sample

    241209-xkhqqsslhj

  • MD5

    81a8b86d10e24aa1dce9abe78a6003e1

  • SHA1

    94b9154eef6c092ad539b57449a458ec0dfcd196

  • SHA256

    6f57eaa317afcb0a3ad48f011031de7e0a32057e55ccbeba6961f27f829e745a

  • SHA512

    51e8a74ecc49ce6218bfe59b7c01828c3e8c76af542c98dc5fd1a9f94157b4febd8c19995213390580f993f2f929e6139becf51e25b94404fdcad126cf39f395

  • SSDEEP

    49152:DvrI22SsaNYfdPBldt698dBcjHgERJ6hbR3LoGdgTHHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjHgERJ6D

Score
10/10
quasarroarspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roar

C2

lkjhblskhg-49405.portmap.host:49405

Mutex

5561e906-e428-4f00-a29e-9139fc28a77c

Attributes
  • encryption_key

    C5904FDD788EA00F921C538B9FE80C0B0A0DE728

  • install_name

    roar.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    discord

  • subdirectory

    SubDir

Targets

    • Target

      rararararararaaar.exe

    • Size

      3.1MB

    • MD5

      81a8b86d10e24aa1dce9abe78a6003e1

    • SHA1

      94b9154eef6c092ad539b57449a458ec0dfcd196

    • SHA256

      6f57eaa317afcb0a3ad48f011031de7e0a32057e55ccbeba6961f27f829e745a

    • SHA512

      51e8a74ecc49ce6218bfe59b7c01828c3e8c76af542c98dc5fd1a9f94157b4febd8c19995213390580f993f2f929e6139becf51e25b94404fdcad126cf39f395

    • SSDEEP

      49152:DvrI22SsaNYfdPBldt698dBcjHgERJ6hbR3LoGdgTHHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjHgERJ6D

    Score
    10/10
    quasarroarspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks