Overview

overview

10

Static

static

1

install.bat

windows7-x64

8

install.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    install.bat

  • Size

    595B

  • Sample

    241211-jc6wpsxqbn

  • MD5

    369f9a8a381c74880783423b98ed52c9

  • SHA1

    3bd04c343b1c361d4e9383010cb0be2380c3dbdb

  • SHA256

    c8cebb25512027ad70b61a647887fa4013489d2dc4294fce853b8363410c423d

  • SHA512

    a139d4d0a7d3f0f6a28690df219cb14adf6a4f0a7ff365bb1e8142ddf8be136ea919e44e4f3108d8fcf344031bff127c701d91b2949501e83d26fdbd6b746c7b

Score
10/10
quasaroffice04executionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Dystopian-62863.portmap.host:62863

Mutex

e1de8f9b-5a7a-4798-a6fb-c03591ef3442

Attributes
  • encryption_key

    8C1BB32BFD240218BA0CB04D65341FB1FDE1E001

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SubStart

  • subdirectory

    SubDir

Targets

    • Target

      install.bat

    • Size

      595B

    • MD5

      369f9a8a381c74880783423b98ed52c9

    • SHA1

      3bd04c343b1c361d4e9383010cb0be2380c3dbdb

    • SHA256

      c8cebb25512027ad70b61a647887fa4013489d2dc4294fce853b8363410c423d

    • SHA512

      a139d4d0a7d3f0f6a28690df219cb14adf6a4f0a7ff365bb1e8142ddf8be136ea919e44e4f3108d8fcf344031bff127c701d91b2949501e83d26fdbd6b746c7b

    Score
    10/10
    executionquasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks