Overview

overview

10

Static

static

10

plswork.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    plswork.exe

  • Size

    3.1MB

  • Sample

    250102-qlsh1awmbr

  • MD5

    6177caea7e42e38c38bc0bd47bb9331c

  • SHA1

    76e6b53c666212a9dd06c943f22cc360c5756b36

  • SHA256

    759d5281882dfba5e7504f46a71c534a7b844701fda511149bc38c3ff53be0f1

  • SHA512

    dc2ce7aedf1c93b06e22e8995e38e89057165aa07d5dc381e48588a1174b099d6d0c88aebc5cdabed9edf6d730e5bb3a884caa2064815a68cc16860f707997f3

  • SSDEEP

    49152:XvTlL26AaNeWgPhlmVqvMQ7XSKW/RJ6FbR3LoGd45THHB72eh2NT:XvJL26AaNeWgPhlmVqkQ7XSKW/RJ6X

Score
10/10
quasarfirstspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

first

C2

nature-documented.gl.at.ply.gg:57757

Mutex

1fae1825-d0ee-4a31-a2bb-ad761ecb2c11

Attributes
  • encryption_key

    59DD70006F5E5424ACBA442199524AA9815F439E

  • install_name

    Calculator.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    RtkAudUService86

  • subdirectory

    Calculator_UWP

Targets

    • Target

      plswork.exe

    • Size

      3.1MB

    • MD5

      6177caea7e42e38c38bc0bd47bb9331c

    • SHA1

      76e6b53c666212a9dd06c943f22cc360c5756b36

    • SHA256

      759d5281882dfba5e7504f46a71c534a7b844701fda511149bc38c3ff53be0f1

    • SHA512

      dc2ce7aedf1c93b06e22e8995e38e89057165aa07d5dc381e48588a1174b099d6d0c88aebc5cdabed9edf6d730e5bb3a884caa2064815a68cc16860f707997f3

    • SSDEEP

      49152:XvTlL26AaNeWgPhlmVqvMQ7XSKW/RJ6FbR3LoGd45THHB72eh2NT:XvJL26AaNeWgPhlmVqkQ7XSKW/RJ6X

    Score
    10/10
    quasarfirstspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks