Overview

overview

10

Static

static

10

Wave.exe

windows7-x64

10

Wave.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Wave.exe

  • Size

    348KB

  • Sample

    241230-yb5dtavqbr

  • MD5

    2e7510e5fe1be2775c6121bb6938b12e

  • SHA1

    e0d45a01f51c27241dde8444493f77b5f9067fec

  • SHA256

    40525cff979beb41423e0f62c34534c7ba0b6247d2b4b1e59b5530730b6d444f

  • SHA512

    04e1f49383fa6afa36243227b4e5e7f5b93c2a4c72eb9ebf21cdfef1562234d85a357d8440a00ecde3b81fab85166d7ed9353b64e09959b5bbc38ff37496c2db

  • SSDEEP

    6144:WONHXf500M9GCZ07NEUV7/ObEkgdV4dEvofhwQfhG:td50kJEUVbzkgdOd1fWQfhG

Score
10/10
quasarwavediscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Wave

C2

69.203.201.20:63604

Mutex

QSR_MUTEX_n0f6at7YDD5llBKKrq

Attributes
  • encryption_key

    b3G1emXfh7duwNMYxuBC

  • install_name

    Wave.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WaveExec

  • subdirectory

    Waveinstallation

Targets

    • Target

      Wave.exe

    • Size

      348KB

    • MD5

      2e7510e5fe1be2775c6121bb6938b12e

    • SHA1

      e0d45a01f51c27241dde8444493f77b5f9067fec

    • SHA256

      40525cff979beb41423e0f62c34534c7ba0b6247d2b4b1e59b5530730b6d444f

    • SHA512

      04e1f49383fa6afa36243227b4e5e7f5b93c2a4c72eb9ebf21cdfef1562234d85a357d8440a00ecde3b81fab85166d7ed9353b64e09959b5bbc38ff37496c2db

    • SSDEEP

      6144:WONHXf500M9GCZ07NEUV7/ObEkgdV4dEvofhwQfhG:td50kJEUVbzkgdOd1fWQfhG

    Score
    10/10
    quasarwavediscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks