Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241215-2pvnba1kas

  • MD5

    85b177add44a49f07c6610191c064bbc

  • SHA1

    7766290221b9dafd7c0d6d983070f55863ed1b26

  • SHA256

    7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb

  • SHA512

    0a4d7e6a5c3e2d63a92f2ae57ab68561f47e827edffea6ea83aebac8286aab886c3bd98c6e791222411d272a925e8b3e03e14dc1b1017aaa449c1b0674717798

  • SSDEEP

    49152:TvChBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUEGiBeHLoVd2THHB72eh2NT:Tv8t2d5aKCuVPzlEmVQ0wvwf/Gp

Score
10/10
quasarratteddiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ratted

C2

localhost:4782

87.97.126.177:4782
Mutex

48887e39-00c3-4c7d-9fbd-aa9bee5b1a88

Attributes
  • encryption_key

    CD36E224C70A801E8033FBB0E5129B1EA712AE1D

  • install_name

    Windows Font Manager.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Font Manager

  • subdirectory

    Fonts

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      85b177add44a49f07c6610191c064bbc

    • SHA1

      7766290221b9dafd7c0d6d983070f55863ed1b26

    • SHA256

      7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb

    • SHA512

      0a4d7e6a5c3e2d63a92f2ae57ab68561f47e827edffea6ea83aebac8286aab886c3bd98c6e791222411d272a925e8b3e03e14dc1b1017aaa449c1b0674717798

    • SSDEEP

      49152:TvChBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUEGiBeHLoVd2THHB72eh2NT:Tv8t2d5aKCuVPzlEmVQ0wvwf/Gp

    Score
    10/10
    quasarrattedspywaretrojandiscovery

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks