Overview

overview

10

Static

static

10

e3d17377d5...de.exe

windows7-x64

10

e3d17377d5...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b48f94c872bb4e3596924f7f587b0a54.bin

  • Size

    1.2MB

  • Sample

    250107-b3f4zazpar

  • MD5

    e6cdd20dda09c4ae01e6c3938ee92349

  • SHA1

    2c9b8ebc444a0bcdd2fc3d1b3079d6a0b18e77bf

  • SHA256

    4d358d8b4798bbc28617acdd1a39a820a94bb08f954f69ad1659c1d8c0767ca6

  • SHA512

    cdf6b8a1cf740828f27c80a02e8e11e5a33f05349c855034c5008b0bb599443a3985d59c47bd7014a4e0bd2e82f5ce951a54e6380ca1d5b669040ff239f3addc

  • SSDEEP

    24576:7xAY0nIlPjw8ffys3p+DHSo1MzFBWI9ackXYVVX59u9zBWJnx5AbjNE:7H+IBjBfPZ+DyFFBZaHXo9u0JnD2pE

Score
10/10
quasarminerspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Miner

C2

154.216.19.144:7000

Mutex

9aaccf69-ec3a-44b7-854b-ecd43ee8e151

Attributes
  • encryption_key

    4A883D3FC8F269324ACDCF0E4B7FFECA042CD47D

  • install_name

    Svc.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Svc

  • subdirectory

    SubDir

Targets

    • Target

      e3d17377d59312e36a5e3b503a7259ffeaac4dd742222be0ad9a8ea443d3f7de.exe

    • Size

      3.1MB

    • MD5

      b48f94c872bb4e3596924f7f587b0a54

    • SHA1

      748f86a0394486b577978794145328702ac77a62

    • SHA256

      e3d17377d59312e36a5e3b503a7259ffeaac4dd742222be0ad9a8ea443d3f7de

    • SHA512

      2704c862668c3ad9f9222761b91861b1c84d84021c1309b309f5cd267fc77e542ca2c821dccb2d9ff2f2063dbc5b604204c2969fa68c7a0de3f2e40039655da1

    • SSDEEP

      49152:yvtt62XlaSFNWPjljiFa2RoUYIDHxEESEQk/iRLoGdv1THHB72eh2NT:yvP62XlaSFNWPjljiFXRoUYIbxEh

    Score
    10/10
    quasarminerspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks