General

  • Target

    5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c.exe

  • Size

    3.1MB

  • Sample

    241217-dl2epazkdm

  • MD5

    1c1a86dad78326429577ab0b7b7b5858

  • SHA1

    cf9aeb9a02d368918d89fc69d55b38829ab83039

  • SHA256

    5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c

  • SHA512

    db9658604a62090fd69cbb7504bf320c947473dfdb10be9e7e866af0a47db228755c1ff8e740eacbe20481df71bc5527347c4185e831515b30ab91b07e46b204

  • SSDEEP

    49152:SvnI22SsaNYfdPBldt698dBcjH9pg1JbLoGdwnTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjH9p4

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.101:4782

Mutex

20f2b2b5-8392-4fbe-9585-0778c516b863

Attributes
  • encryption_key

    3A9499E06EC8E749CF7AE8F7D466BD97D9B2380C

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c.exe

    • Size

      3.1MB

    • MD5

      1c1a86dad78326429577ab0b7b7b5858

    • SHA1

      cf9aeb9a02d368918d89fc69d55b38829ab83039

    • SHA256

      5df3470db00597e3da516459648dfa6a2c1564a57c1d51817d952beeeb860a2c

    • SHA512

      db9658604a62090fd69cbb7504bf320c947473dfdb10be9e7e866af0a47db228755c1ff8e740eacbe20481df71bc5527347c4185e831515b30ab91b07e46b204

    • SSDEEP

      49152:SvnI22SsaNYfdPBldt698dBcjH9pg1JbLoGdwnTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjH9p4

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks