Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    241227-1ek6fszrbp

  • MD5

    adc809b75572fa46fda9f842728dd9fb

  • SHA1

    8bfb4918f551b2f04551504b6047539d673e30f6

  • SHA256

    4b1dfcbfe76d3b2778598bf41e3873665d0bdfae115735ca1332bed8aa50e2df

  • SHA512

    2041fa4fbd8948f05658a205d4a2a702cf6865f6982e08f37c0fd2f4d207c69199699678cf4fce18dc6fa25f41269720a00f8fbd5e0d00456b849d644246a465

  • SSDEEP

    49152:avAt62XlaSFNWPjljiFa2RoUYIEgRJ63bR3LoGd+THHB72eh2NT:avs62XlaSFNWPjljiFXRoUYIEgRJ6J

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.31.68:4782

Mutex

05ee7805-26a7-4761-b21c-d55dcaa31857

Attributes
  • encryption_key

    B444CC22137E58A588D9597C46888B34DA3BD016

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      adc809b75572fa46fda9f842728dd9fb

    • SHA1

      8bfb4918f551b2f04551504b6047539d673e30f6

    • SHA256

      4b1dfcbfe76d3b2778598bf41e3873665d0bdfae115735ca1332bed8aa50e2df

    • SHA512

      2041fa4fbd8948f05658a205d4a2a702cf6865f6982e08f37c0fd2f4d207c69199699678cf4fce18dc6fa25f41269720a00f8fbd5e0d00456b849d644246a465

    • SSDEEP

      49152:avAt62XlaSFNWPjljiFa2RoUYIEgRJ63bR3LoGd+THHB72eh2NT:avs62XlaSFNWPjljiFXRoUYIEgRJ6J

    Score
    10/10
    quasaroffice04spywaretrojandiscovery

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks