Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241226-t5zm7s1jds

  • MD5

    878ebdf1e55421d4fdb712ba2e427cfe

  • SHA1

    fa6d04743a198c16261a3dbc14f6cd1f0fbc70aa

  • SHA256

    ee1411bf2015e16b221d444007a0b60b8f98f842e110198c3a2fb119b459a3da

  • SHA512

    cc9a4d7d4f411ba5b8836faceb1fae2605c96502f1f5f0b935e2c7a62bfe9641b84b30eba1ed3f12757c5cae244d5870bd153272d6760694f7f101e713f69173

  • SSDEEP

    49152:uvAG42pda6D+/PjlLOlg6yQipVZxOEMkKk/JxnoGd5K5THHB72eh2NT:uvD42pda6D+/PjlLOlZyQipVZxBx

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

http://stable-notably-hound.ngrok-free.app/:443

Mutex

8f9ed790-a4d4-42d4-a715-3c3c28f6d95b

Attributes
  • encryption_key

    A5F0EE2DBE7A3009387617912AFB48C127E2B576

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      878ebdf1e55421d4fdb712ba2e427cfe

    • SHA1

      fa6d04743a198c16261a3dbc14f6cd1f0fbc70aa

    • SHA256

      ee1411bf2015e16b221d444007a0b60b8f98f842e110198c3a2fb119b459a3da

    • SHA512

      cc9a4d7d4f411ba5b8836faceb1fae2605c96502f1f5f0b935e2c7a62bfe9641b84b30eba1ed3f12757c5cae244d5870bd153272d6760694f7f101e713f69173

    • SSDEEP

      49152:uvAG42pda6D+/PjlLOlg6yQipVZxOEMkKk/JxnoGd5K5THHB72eh2NT:uvD42pda6D+/PjlLOlZyQipVZxBx

    Score
    10/10
    quasaroffice04discoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks