Overview

overview

10

Static

static

10

Bootstrapp...14.exe

windows10-2004-x64

10

Bootstrapp...14.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper v3.14.exe

  • Size

    3.1MB

  • Sample

    250109-mcfw3ayrek

  • MD5

    16f639c27fead4d665ab798bd4a8c457

  • SHA1

    c596c009318ba3777e962661355a199b9b4ed5e7

  • SHA256

    afe5f6d8d87bb93548faec17805bd3b68f8e7914ac07ad0bfa60ab465fdc5a0a

  • SHA512

    ba71490f2433062dfd07bf84f6e85e06e9fad412e7baaa81c8519d32c09dd97316f3729ec1bc425c49f7eb95601499330baeb86abd7ea92ef071e39823d46ec8

  • SSDEEP

    49152:mv3I22SsaNYfdPBldt698dBcjHw186GBxQ+oGdlR5THHB72eh2NT:mv422SsaNYfdPBldt6+dBcjHl6c

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.62.1:4782

Mutex

948fde50-66bb-4ffd-aeca-4cc76d13c423

Attributes
  • encryption_key

    FE78C5AAB1B8DB7C1492A05B7A35D613C6807754

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      Bootstrapper v3.14.exe

    • Size

      3.1MB

    • MD5

      16f639c27fead4d665ab798bd4a8c457

    • SHA1

      c596c009318ba3777e962661355a199b9b4ed5e7

    • SHA256

      afe5f6d8d87bb93548faec17805bd3b68f8e7914ac07ad0bfa60ab465fdc5a0a

    • SHA512

      ba71490f2433062dfd07bf84f6e85e06e9fad412e7baaa81c8519d32c09dd97316f3729ec1bc425c49f7eb95601499330baeb86abd7ea92ef071e39823d46ec8

    • SSDEEP

      49152:mv3I22SsaNYfdPBldt698dBcjHw186GBxQ+oGdlR5THHB72eh2NT:mv422SsaNYfdPBldt6+dBcjHl6c

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks