Overview

overview

10

Static

static

10

Discord.exe

windows7-x64

10

Discord.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Discord.exe

  • Size

    3.1MB

  • Sample

    241213-mcj9gsxkdq

  • MD5

    bedd5e5f44b78c79f93e29dc184cfa3d

  • SHA1

    11e7e692b9a6b475f8561f283b2dd59c3cd19bfd

  • SHA256

    e423c72ea1a279e367f4f0a3dc7d703c67f6d09009ed9d58f9c73dac35d0a85c

  • SHA512

    3a7924196830b52d4525b897f45feb52ec2aca6cd20437b38437f171424450fd25692bd4c67ccde2cf147f0ed6efcef395ea0e13b24f0cf606214b58cf8284de

  • SSDEEP

    49152:IvzlL26AaNeWgPhlmVqvMQ7XSKzFxNESEtk/iPLoGdVTHHB72eh2NTRR:IvpL26AaNeWgPhlmVqkQ7XSKBxgTE

Score
10/10
quasarpowerstealerspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

powerstealer

C2

192.168.56.1:4782

Mutex

6760d0e9-9df9-4aba-89be-4e5ce3e92cc8

Attributes
  • encryption_key

    057FCAF700E62ACFECC7338C474084AF9B47ABEB

  • install_name

    powerstealer.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Discord.exe

    • Size

      3.1MB

    • MD5

      bedd5e5f44b78c79f93e29dc184cfa3d

    • SHA1

      11e7e692b9a6b475f8561f283b2dd59c3cd19bfd

    • SHA256

      e423c72ea1a279e367f4f0a3dc7d703c67f6d09009ed9d58f9c73dac35d0a85c

    • SHA512

      3a7924196830b52d4525b897f45feb52ec2aca6cd20437b38437f171424450fd25692bd4c67ccde2cf147f0ed6efcef395ea0e13b24f0cf606214b58cf8284de

    • SSDEEP

      49152:IvzlL26AaNeWgPhlmVqvMQ7XSKzFxNESEtk/iPLoGdVTHHB72eh2NTRR:IvpL26AaNeWgPhlmVqkQ7XSKBxgTE

    Score
    10/10
    quasarpowerstealerspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks