Overview

overview

10

Static

static

10

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1.exe

  • Size

    3.1MB

  • Sample

    250105-r2b2mayqhn

  • MD5

    b48f94c872bb4e3596924f7f587b0a54

  • SHA1

    748f86a0394486b577978794145328702ac77a62

  • SHA256

    e3d17377d59312e36a5e3b503a7259ffeaac4dd742222be0ad9a8ea443d3f7de

  • SHA512

    2704c862668c3ad9f9222761b91861b1c84d84021c1309b309f5cd267fc77e542ca2c821dccb2d9ff2f2063dbc5b604204c2969fa68c7a0de3f2e40039655da1

  • SSDEEP

    49152:yvtt62XlaSFNWPjljiFa2RoUYIDHxEESEQk/iRLoGdv1THHB72eh2NT:yvP62XlaSFNWPjljiFXRoUYIbxEh

Score
10/10
quasarminerspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Miner

C2

154.216.19.144:7000

Mutex

9aaccf69-ec3a-44b7-854b-ecd43ee8e151

Attributes
  • encryption_key

    4A883D3FC8F269324ACDCF0E4B7FFECA042CD47D

  • install_name

    Svc.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Svc

  • subdirectory

    SubDir

Targets

    • Target

      1.exe

    • Size

      3.1MB

    • MD5

      b48f94c872bb4e3596924f7f587b0a54

    • SHA1

      748f86a0394486b577978794145328702ac77a62

    • SHA256

      e3d17377d59312e36a5e3b503a7259ffeaac4dd742222be0ad9a8ea443d3f7de

    • SHA512

      2704c862668c3ad9f9222761b91861b1c84d84021c1309b309f5cd267fc77e542ca2c821dccb2d9ff2f2063dbc5b604204c2969fa68c7a0de3f2e40039655da1

    • SSDEEP

      49152:yvtt62XlaSFNWPjljiFa2RoUYIDHxEESEQk/iRLoGdv1THHB72eh2NT:yvP62XlaSFNWPjljiFXRoUYIbxEh

    Score
    10/10
    quasarminerspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks