Overview

overview

10

Static

static

10

1ba41fb95f...80.exe

windows7-x64

10

1ba41fb95f...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80.exe

  • Size

    502KB

  • Sample

    241217-cp8shaykar

  • MD5

    f5b150d54a0ba2d902974cbfd6249c56

  • SHA1

    92e28c3d9ff4392eed379d816dda6939113830bd

  • SHA256

    1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

  • SHA512

    57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

  • SSDEEP

    12288:gTEgdfYv/izUrFL4dywjapf/WI2TI/uqcdj:1Uwwq+ywjapHWbEcdj

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.31.99:4782

2001:4bc9:1f98:a4e::676:4782

255.255.255.0:4782

fe80::cabf:4cff:fe84:9572%17:4782
Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes
  • encryption_key

    A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9

  • install_name

    Neverlose Loader.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Targets

    • Target

      1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80.exe

    • Size

      502KB

    • MD5

      f5b150d54a0ba2d902974cbfd6249c56

    • SHA1

      92e28c3d9ff4392eed379d816dda6939113830bd

    • SHA256

      1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

    • SHA512

      57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

    • SSDEEP

      12288:gTEgdfYv/izUrFL4dywjapf/WI2TI/uqcdj:1Uwwq+ywjapHWbEcdj

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks