Overview

overview

10

Static

static

10

ClientX.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ClientX.exe

  • Size

    3.4MB

  • Sample

    250108-x919daspgj

  • MD5

    8142104d55fc9ffeb5e79b5639ac2f2b

  • SHA1

    2e9c324236f682ad4dbe7b5ee967676a2f40635c

  • SHA256

    d26249928948f80fb0d520d8515473e343eec4bec3e45a5dfd2f3db7e518ffd2

  • SHA512

    33142888451fa4f1fd0967da541683c63d75adb74a9839f08d1d2540c6db3d3e38a05edb58745240c9c7868ffa8405bf8f975b7d94be52cccc4b3c17e06bbd0c

  • SSDEEP

    49152:LvPlL26AaNeWgPhlmVqvMQ7XSKK+xNESEok/ilLoGdUeTHHB72eh2NT:LvdL26AaNeWgPhlmVqkQ7XSKHxf9

Score
10/10
quasarclientxdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ClientX

C2

o0p2e195m0-34052.portmap.host:34052

Mutex

b0299f3a-cce4-49aa-845a-55429d915187

Attributes
  • encryption_key

    CFE2CEC16AA74627FAD2363341BA64A4E9D48B7B

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    Client

Targets

    • Target

      ClientX.exe

    • Size

      3.4MB

    • MD5

      8142104d55fc9ffeb5e79b5639ac2f2b

    • SHA1

      2e9c324236f682ad4dbe7b5ee967676a2f40635c

    • SHA256

      d26249928948f80fb0d520d8515473e343eec4bec3e45a5dfd2f3db7e518ffd2

    • SHA512

      33142888451fa4f1fd0967da541683c63d75adb74a9839f08d1d2540c6db3d3e38a05edb58745240c9c7868ffa8405bf8f975b7d94be52cccc4b3c17e06bbd0c

    • SSDEEP

      49152:LvPlL26AaNeWgPhlmVqvMQ7XSKK+xNESEok/ilLoGdUeTHHB72eh2NT:LvdL26AaNeWgPhlmVqkQ7XSKHxf9

    Score
    10/10
    quasarclientxdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks