Overview

overview

10

Static

static

10

Client-built.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241215-s4r2asylfw

  • MD5

    749286088524b5c49a9f6fd5dd15de49

  • SHA1

    bc255bc2f5a7f50e8fec2e5eca55c82de0bb15a2

  • SHA256

    e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587

  • SHA512

    b0ac4798d04e443f6e795e718bf301a885bc96ab2bd12f4d2b14d47e75aa897b5f53c22dab14b95a12a4f2e177d86a78a0af08ab916906a9a9ce7eb0b860dd8e

  • SSDEEP

    49152:WvWI22SsaNYfdPBldt698dBcjHSlRJ6ibR3LoGd09THHB72eh2NT:Wv722SsaNYfdPBldt6+dBcjHSlRJ6c

Score
10/10
quasarkdotcryptdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KDOTCrypt

C2

fedx.ddns.net:7000

Mutex

f70e50c5-1467-4cc3-8be1-b4ca15c11c35

Attributes
  • encryption_key

    92470F4731518ABFA77DC89068544FB7E7B7C459

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      749286088524b5c49a9f6fd5dd15de49

    • SHA1

      bc255bc2f5a7f50e8fec2e5eca55c82de0bb15a2

    • SHA256

      e1dd16d3d0550466cd1e5efa60ea8f0d3b204f52ddccb4b58d46a7dba9dc5587

    • SHA512

      b0ac4798d04e443f6e795e718bf301a885bc96ab2bd12f4d2b14d47e75aa897b5f53c22dab14b95a12a4f2e177d86a78a0af08ab916906a9a9ce7eb0b860dd8e

    • SSDEEP

      49152:WvWI22SsaNYfdPBldt698dBcjHSlRJ6ibR3LoGd09THHB72eh2NT:Wv722SsaNYfdPBldt6+dBcjHSlRJ6c

    Score
    10/10
    quasarkdotcryptdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks