Overview

overview

10

Static

static

10

cliento.zip

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cliento.zip

  • Size

    1.2MB

  • Sample

    241226-d6ndkawlhq

  • MD5

    9748809c3ec4881eda92f259b4d7c007

  • SHA1

    3f036b3896e7f5586c5e762f0b5e47e34f76228f

  • SHA256

    f84bd9538137af690b0acd123b7f91cae6c7e08dc0f0640f379658d2c4ee7e91

  • SHA512

    ae4cf64ee83503d99e8d06408a2db78625b5e8248324f2288400f46a509dcbdb55d7f564cc4878692fe3c0bfbb5a2225ae6751164e46385157f14b3115fa400c

  • SSDEEP

    24576:CEZPc7LVJCGexfUkbHb++qy2W92QifC40v4V5StrO/uIZuiMwZF:CEZPcWGexzRGW92QiX+trOWsMq

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.56.1:4782

Mutex

9f808638-1d71-4cd8-bcba-dc4258c5567c

Attributes
  • encryption_key

    50594C0487E73C95F03F5F7C150B052B4C74F9BE

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      cliento.zip

    • Size

      1.2MB

    • MD5

      9748809c3ec4881eda92f259b4d7c007

    • SHA1

      3f036b3896e7f5586c5e762f0b5e47e34f76228f

    • SHA256

      f84bd9538137af690b0acd123b7f91cae6c7e08dc0f0640f379658d2c4ee7e91

    • SHA512

      ae4cf64ee83503d99e8d06408a2db78625b5e8248324f2288400f46a509dcbdb55d7f564cc4878692fe3c0bfbb5a2225ae6751164e46385157f14b3115fa400c

    • SSDEEP

      24576:CEZPc7LVJCGexfUkbHb++qy2W92QifC40v4V5StrO/uIZuiMwZF:CEZPcWGexzRGW92QiX+trOWsMq

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks