Overview

overview

10

Static

static

3

d015e99afd...2d.exe

windows7-x64

10

d015e99afd...2d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d015e99afd1bb21e6ba6abf2a2a053ea1b4822904ac3a84791459f1b6d74af2d.exe

  • Size

    34KB

  • Sample

    241231-cpc1tsynbn

  • MD5

    4677d0618c8a4573df5013b28c71db32

  • SHA1

    411c8767255d0b1b04c6f1188efb5e8c08e233a7

  • SHA256

    d015e99afd1bb21e6ba6abf2a2a053ea1b4822904ac3a84791459f1b6d74af2d

  • SHA512

    4590e44321804914e5ab393897ed0d442120116ffc0c21db6c3f4bde0b2ec85f580eb0142e576f094dc380e6cbb42b1c0961a83b20943e5dbee6b6f4174c12c9

  • SSDEEP

    768:YaW5wDyJUqGXW5ezbAUnc8DYNRWT8uj+IqxAkHGe2ay:YaWGyiqGX6edc8DYDWTXNBeZy

Score
10/10
quasarruntime brokerspywaretrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

C2

92.221.125.55:49868

Mutex

73f0bf3a-83f3-424b-b7a1-a8200df3e317

Attributes
  • encryption_key

    5CB2755608EFDB1313EF4F2ACEA101833F5AEE2B

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    System

  • subdirectory

    SubDir

Targets

    • Target

      d015e99afd1bb21e6ba6abf2a2a053ea1b4822904ac3a84791459f1b6d74af2d.exe

    • Size

      34KB

    • MD5

      4677d0618c8a4573df5013b28c71db32

    • SHA1

      411c8767255d0b1b04c6f1188efb5e8c08e233a7

    • SHA256

      d015e99afd1bb21e6ba6abf2a2a053ea1b4822904ac3a84791459f1b6d74af2d

    • SHA512

      4590e44321804914e5ab393897ed0d442120116ffc0c21db6c3f4bde0b2ec85f580eb0142e576f094dc380e6cbb42b1c0961a83b20943e5dbee6b6f4174c12c9

    • SSDEEP

      768:YaW5wDyJUqGXW5ezbAUnc8DYNRWT8uj+IqxAkHGe2ay:YaWGyiqGX6edc8DYDWTXNBeZy

    Score
    10/10
    quasarruntime brokerspywaretrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks