Overview

overview

10

Static

static

10

FlashingSo...RO.exe

windows7-x64

10

FlashingSo...RO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FlashingSoftwarePRO.exe

  • Size

    3.1MB

  • Sample

    241220-wkrsza1kcy

  • MD5

    fe32c6ee65da2e4e98d4ce1c355f55d0

  • SHA1

    511b2e427433d6424eac156345e014df1f06dc27

  • SHA256

    eebe90526e43666cbcc8e62f138cc17fb3a11e5fc6c553b1ba73361cabcd5829

  • SHA512

    c17d2f342f8f28f23fe4d7f5822b6130e00e44291ffcecf4f14198cb13716d07af4724951502fb5b5f306bae91c8d8028b230b91194d7d6760db05b128243e3f

  • SSDEEP

    49152:PvJuf2NUaNmwzPWlvdaKM7ZxTwcxDk9hGvJQLoGdTITHHB72eh2NT:Pvkf2NUaNmwzPWlvdaB7ZxTwDhV

Score
10/10
quasarsvchostspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

svchost

C2

air-specials.gl.at.ply.gg:4782

air-specials.gl.at.ply.gg:38318
Mutex

bd7b6fc7-5465-4c8c-b9fc-771a94c5bf3b

Attributes
  • encryption_key

    BDB44181C868606DFCA1741A69056AAA62DADEFC

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    RuntimeBroker

  • subdirectory

    System32

Targets

    • Target

      FlashingSoftwarePRO.exe

    • Size

      3.1MB

    • MD5

      fe32c6ee65da2e4e98d4ce1c355f55d0

    • SHA1

      511b2e427433d6424eac156345e014df1f06dc27

    • SHA256

      eebe90526e43666cbcc8e62f138cc17fb3a11e5fc6c553b1ba73361cabcd5829

    • SHA512

      c17d2f342f8f28f23fe4d7f5822b6130e00e44291ffcecf4f14198cb13716d07af4724951502fb5b5f306bae91c8d8028b230b91194d7d6760db05b128243e3f

    • SSDEEP

      49152:PvJuf2NUaNmwzPWlvdaKM7ZxTwcxDk9hGvJQLoGdTITHHB72eh2NT:Pvkf2NUaNmwzPWlvdaB7ZxTwDhV

    Score
    10/10
    quasarsvchostspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks