Overview

overview

10

Static

static

3

1ea435b20d...4N.exe

windows7-x64

10

1ea435b20d...4N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ea435b20d035f0fe69f12f4522d847517d65073eeb520ded8e15e2bc620a504N.exe

  • Size

    34KB

  • Sample

    241231-jj34ds1ncn

  • MD5

    9ebbc71d0fa2faaf39de4d1159e24ea0

  • SHA1

    127bee41ea4b24d0fd6e82f981962d9ad10c5abe

  • SHA256

    1ea435b20d035f0fe69f12f4522d847517d65073eeb520ded8e15e2bc620a504

  • SHA512

    53f00078592b454a407544c68ae67e5e3310e0e830a8fdbc9b1a55964769d248ebddfa36964513233cc2228750fc3ef0d141968b316ab54db8bc4721ed671148

  • SSDEEP

    768:YaW5wDyJUqGXW5ezbAUnc8DYNRWT8uj+IqxAkHGe2a:YaWGyiqGX6edc8DYDWTXNBeZ

Score
10/10
quasarruntime brokerspywaretrojanupx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

C2

92.221.125.55:49868

Mutex

73f0bf3a-83f3-424b-b7a1-a8200df3e317

Attributes
  • encryption_key

    5CB2755608EFDB1313EF4F2ACEA101833F5AEE2B

  • install_name

    Runtime Broker.exe

  • log_directory

    Logs

  • reconnect_delay

    100

  • startup_key

    System

  • subdirectory

    SubDir

Targets

    • Target

      1ea435b20d035f0fe69f12f4522d847517d65073eeb520ded8e15e2bc620a504N.exe

    • Size

      34KB

    • MD5

      9ebbc71d0fa2faaf39de4d1159e24ea0

    • SHA1

      127bee41ea4b24d0fd6e82f981962d9ad10c5abe

    • SHA256

      1ea435b20d035f0fe69f12f4522d847517d65073eeb520ded8e15e2bc620a504

    • SHA512

      53f00078592b454a407544c68ae67e5e3310e0e830a8fdbc9b1a55964769d248ebddfa36964513233cc2228750fc3ef0d141968b316ab54db8bc4721ed671148

    • SSDEEP

      768:YaW5wDyJUqGXW5ezbAUnc8DYNRWT8uj+IqxAkHGe2a:YaWGyiqGX6edc8DYDWTXNBeZ

    Score
    10/10
    quasarruntime brokerspywaretrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks