Overview

overview

10

Static

static

1

NiggaKernel.bat

windows7-x64

8

NiggaKernel.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NiggaKernel.bat

  • Size

    1.8MB

  • Sample

    250110-f1dchswkfj

  • MD5

    049e158c496e1d81b51d8c3e85d769dc

  • SHA1

    29717cc27f715c86e95b2027c87331c7b7f6a688

  • SHA256

    8a571346e3190daf5e2b5b30dea032feab8726dd423ec1446f0863d76cc9cd80

  • SHA512

    d81710454d8424e19b009b86d71938d101eee2a5b8b260a062d1931f59e1b38c0b05192b684c69218d46fee191744d7871c32e96376033347fa310274753163d

  • SSDEEP

    24576:6JTtOJAdMrNp8QL585hVGeA7TycnoAE33Lio++/q1Bm6dS585gL2n6:8rEtoA+7qa6f5zn6

Score
10/10
quasarniggavictimexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

NiggaVictim

C2

TheSillyValor-36700.portmap.host:36700

Mutex

6c3995b9-837d-4aad-89fd-b25da7ae4c30

Attributes
  • encryption_key

    029FCE648CA3D58DA3A16C9A8EBE57C1E2BA129C

  • install_name

    niggakernel.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    niggakernel

  • subdirectory

    niggakernel

Targets

    • Target

      NiggaKernel.bat

    • Size

      1.8MB

    • MD5

      049e158c496e1d81b51d8c3e85d769dc

    • SHA1

      29717cc27f715c86e95b2027c87331c7b7f6a688

    • SHA256

      8a571346e3190daf5e2b5b30dea032feab8726dd423ec1446f0863d76cc9cd80

    • SHA512

      d81710454d8424e19b009b86d71938d101eee2a5b8b260a062d1931f59e1b38c0b05192b684c69218d46fee191744d7871c32e96376033347fa310274753163d

    • SSDEEP

      24576:6JTtOJAdMrNp8QL585hVGeA7TycnoAE33Lio++/q1Bm6dS585gL2n6:8rEtoA+7qa6f5zn6

    Score
    10/10
    executionquasarniggavictimspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks