Overview

overview

10

Static

static

3

FortniteExternal.exe

windows7-x64

10

FortniteExternal.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FortniteExternal.exe

  • Size

    37KB

  • Sample

    241229-ll2z8aylbz

  • MD5

    ba116c70830d49029c03acbb2f2fac1b

  • SHA1

    ec5de491b7910e25b5bfb7e8803b30186b38a71d

  • SHA256

    96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3

  • SHA512

    768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410

  • SSDEEP

    384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7

Score
10/10
quasarruntime brokerspywaretrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

C2

92.221.125.55:49868

Mutex

73f0bf3a-83f3-424b-b7a1-a8200df3e317

Attributes
  • encryption_key

    5CB2755608EFDB1313EF4F2ACEA101833F5AEE2B

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    System

  • subdirectory

    SubDir

Targets

    • Target

      FortniteExternal.exe

    • Size

      37KB

    • MD5

      ba116c70830d49029c03acbb2f2fac1b

    • SHA1

      ec5de491b7910e25b5bfb7e8803b30186b38a71d

    • SHA256

      96391e7351eeec459e219aa35afd521e528eca4bf32d0aaf4ff018392c4894e3

    • SHA512

      768328944e44f88fc116376045b934ab251362ea41349ce0c4b968abbb09ce6a3060d70cd75344acb72b6db8c51c164dcf56ac3279ca2e1608bbbbc65b09c410

    • SSDEEP

      384:aLi12fprueXnMnUNGNlrFV5ga0gEVjIMDYf4/ERnvawR6KhzVcQSgafw2IwrWGcp:+Im6nUjIMDPEJ5h3X2rjmeCt070H7

    Score
    10/10
    quasarruntime brokerspywaretrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks