Overview

overview

10

Static

static

3

JaffaCakes...78.exe

windows10-ltsc 2021-x64

10

Resubmissions

07-01-2025 19:18

250107-x1a1tsvldv 10

07-01-2025 05:26

250107-f4wchawmd1 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_50009ad06a8632a37995f4a94dc76278

  • Size

    950KB

  • Sample

    250107-x1a1tsvldv

  • MD5

    50009ad06a8632a37995f4a94dc76278

  • SHA1

    3105b87fee58f39090ae3cbeb9d09513e5ef3f69

  • SHA256

    44b801fdbc011ac9bec93c1e9fde044e88ea76605b7a1ea5988021ddbf58f6d4

  • SHA512

    2dd4682d736d05b1e845b314234f98b8de554d47618914ae3b9b2e359e76da098dae675c68b8db9c9e14b51ca209f573d758229175abfd2febd270a78bbf7d1a

  • SSDEEP

    24576:1ecCy8fWvhaLU+4tCKsu4JRfl8S7U2MQGmP:hugHt78

Score
10/10
quasarscript kiddiediscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Script Kiddie

C2

NaziSec2-64817.portmap.io:64817

Mutex

01912710-4689-49d7-8331-827532b3887f

Attributes
  • encryption_key

    082CB3A67AAB74DC729A374C73C4CFE478208DA9

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      JaffaCakes118_50009ad06a8632a37995f4a94dc76278

    • Size

      950KB

    • MD5

      50009ad06a8632a37995f4a94dc76278

    • SHA1

      3105b87fee58f39090ae3cbeb9d09513e5ef3f69

    • SHA256

      44b801fdbc011ac9bec93c1e9fde044e88ea76605b7a1ea5988021ddbf58f6d4

    • SHA512

      2dd4682d736d05b1e845b314234f98b8de554d47618914ae3b9b2e359e76da098dae675c68b8db9c9e14b51ca209f573d758229175abfd2febd270a78bbf7d1a

    • SSDEEP

      24576:1ecCy8fWvhaLU+4tCKsu4JRfl8S7U2MQGmP:hugHt78

    Score
    10/10
    quasarscript kiddiediscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks