Overview

overview

10

Static

static

10

cb731802d3...40.exe

windows7-x64

10

cb731802d3...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fcfe990de818ff742c6723b8c6e0d33.bin

  • Size

    1.2MB

  • Sample

    250108-bhafpayrcp

  • MD5

    34ccc2902509ed88e0ea46214127f5c1

  • SHA1

    355943b20391673f692266576b808f75bfc8cb64

  • SHA256

    ea72fe8ea0f99fc5bbef1c3903fbc94bd439b37d1989a9b642c80ce5f6675e3c

  • SHA512

    4c427ad3d9165c8394e91df5115198a6991646ce943aef9d2f868338ce224cd8df339ecaf4a0c9785a1551f6e9061cd1a2ff5df5204325998bf66471fe3214ee

  • SSDEEP

    24576:rgZYbENi1UI0XNzfEUS8v9VZMqF3Y9phEw3sc+4yg+2djPJEhxTqEe1Mt1i:rRdUvzsUS273OhTOLmCTqEqMtI

Score
10/10
quasarsgvpdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

C2

192.168.1.9:4782

150.129.206.176:4782

Ai-Sgvp-33452.portmap.host:33452
Mutex

a35ec7b7-5a95-4207-8f25-7af0a7847fa5

Attributes
  • encryption_key

    09BBDA8FF0524296F02F8F81158F33C0AA74D487

  • install_name

    User Application Data.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windowns Client Startup

  • subdirectory

    Quasar

Targets

    • Target

      cb731802d3cd29da2c01ffbb8c8ed4ef7de9d91c133b69b974583bede6bfd740.exe

    • Size

      3.1MB

    • MD5

      2fcfe990de818ff742c6723b8c6e0d33

    • SHA1

      9d42cce564dcfa27b2c99450f54ba36d4b6eecaf

    • SHA256

      cb731802d3cd29da2c01ffbb8c8ed4ef7de9d91c133b69b974583bede6bfd740

    • SHA512

      4f20a27817de94a07071960abe0123277c0607a26de709e2ade201597df71d8c2eec7da353efba94dc6a8369b89db4caeaf9505d02b90dc30c37010a885c3613

    • SSDEEP

      49152:PvXz92YpaQI6oPZlhP3Reybewoklwuv1JHloGGWTHHB72eh2NT:PvD92YpaQI6oPZlhP3YybewoklwuV

    Score
    10/10
    quasarsgvpdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks