Overview

overview

10

Static

static

10

cclent.exe

windows7-x64

10

cclent.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cclent.exe

  • Size

    3.1MB

  • Sample

    241213-l2s29avlbx

  • MD5

    94222631ef1071a4f7ceb180cf8a4a5a

  • SHA1

    786d8b2d8b931a9282ee54367d2dda501f1ca946

  • SHA256

    a45b373b780f5b9fcf5c51473c69bbf0ed650f300523097602b35f5222bd122b

  • SHA512

    00503983a35e8d0f65eea6a811d7177a389cb1b4d8716d32e50fd5346deb428cd472cbaca7375c56ac3f113ea76db55322993b4d68d816b50a4b27887a2fa14d

  • SSDEEP

    49152:ivht62XlaSFNWPjljiFa2RoUYIo7RJ6SbR3LoGd+vTHHB72eh2NT:ivL62XlaSFNWPjljiFXRoUYIo7RJ6M

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

91.92.243.191:5401

Mutex

fce41024-0e2f-475b-929b-e58a126341bd

Attributes
  • encryption_key

    802CAE367B042C840DD4E29539BB1BFEC16FB48A

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    vchost32

  • subdirectory

    SubDir

Targets

    • Target

      cclent.exe

    • Size

      3.1MB

    • MD5

      94222631ef1071a4f7ceb180cf8a4a5a

    • SHA1

      786d8b2d8b931a9282ee54367d2dda501f1ca946

    • SHA256

      a45b373b780f5b9fcf5c51473c69bbf0ed650f300523097602b35f5222bd122b

    • SHA512

      00503983a35e8d0f65eea6a811d7177a389cb1b4d8716d32e50fd5346deb428cd472cbaca7375c56ac3f113ea76db55322993b4d68d816b50a4b27887a2fa14d

    • SSDEEP

      49152:ivht62XlaSFNWPjljiFa2RoUYIo7RJ6SbR3LoGd+vTHHB72eh2NT:ivL62XlaSFNWPjljiFXRoUYIo7RJ6M

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks