Overview

overview

10

Static

static

3

emmasBackdoor.exe

windows10-ltsc 2021-x64

10

emmasBackdoor.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emmasBackdoor.exe

  • Size

    2.9MB

  • Sample

    241213-v6b4zawkc1

  • MD5

    0266f80fe6efd3e3e4bd0363d17bcbde

  • SHA1

    b144914eb53d2e35e410be64d2db052d06d680df

  • SHA256

    6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

  • SHA512

    21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8

  • SSDEEP

    49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

Score
10/10
quasaremmassubdiscoveryexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

C2

rath3r.xyz:4782

Mutex

7126373e-e872-4f94-bbbb-42e88d57137b

Attributes
  • encryption_key

    4DC093FC202D016F95DCEE92AAF2874F56ACC3F2

  • install_name

    Windows.WARP.JITService.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    MicrosoftUpdateTaskMachineCore

  • subdirectory

    ice

Targets

    • Target

      emmasBackdoor.exe

    • Size

      2.9MB

    • MD5

      0266f80fe6efd3e3e4bd0363d17bcbde

    • SHA1

      b144914eb53d2e35e410be64d2db052d06d680df

    • SHA256

      6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

    • SHA512

      21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8

    • SSDEEP

      49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

    Score
    10/10
    quasaremmassubdiscoveryexecutionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks