Overview

overview

10

Static

static

10

e449e67559...6N.exe

windows7-x64

10

e449e67559...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66N.exe

  • Size

    348KB

  • Sample

    241217-aehr8atrax

  • MD5

    bdb7c04dc8eed14ec4f1b9a6017d8610

  • SHA1

    7144bf748917c7415573adf584cd81c435ebdeb6

  • SHA256

    e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66

  • SHA512

    2849e5300ce3e4f1ce12ea8824d9b0be2bcd6cf7d3b393901e66f1542d9acdf3e09d1d76a887dca6008bd5d07f3223b6f675d548af0a5b246fa40df68cae277e

  • SSDEEP

    6144:mzNHXf500MsYYQiLTVdbw35O7f6v/D2mGipQZb/cVXS:od50LOuOmvr2pipQZb/cVXS

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

192.168.252.1:4782

Mutex

QSR_MUTEX_nAO3ZxsttzfVnn6gik

Attributes
  • encryption_key

    XoQ4ARQwU8sc1owNPsxw

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66N.exe

    • Size

      348KB

    • MD5

      bdb7c04dc8eed14ec4f1b9a6017d8610

    • SHA1

      7144bf748917c7415573adf584cd81c435ebdeb6

    • SHA256

      e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66

    • SHA512

      2849e5300ce3e4f1ce12ea8824d9b0be2bcd6cf7d3b393901e66f1542d9acdf3e09d1d76a887dca6008bd5d07f3223b6f675d548af0a5b246fa40df68cae277e

    • SSDEEP

      6144:mzNHXf500MsYYQiLTVdbw35O7f6v/D2mGipQZb/cVXS:od50LOuOmvr2pipQZb/cVXS

    Score
    10/10
    quasaroffice04discoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks