Resubmissions

17-01-2025 17:18

250117-vvaf1ayjcm 10

14-01-2025 16:41

250114-t7d5aavpck 10

General

  • Target

    voidware_loader.exe

  • Size

    3.1MB

  • Sample

    250114-t7d5aavpck

  • MD5

    d0d7ab7998eee34f17c5299b2e5369d8

  • SHA1

    6c1d3438adeb0b7f21be3c881be8fbee01b4e4f4

  • SHA256

    3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f

  • SHA512

    fcec45df80bbe966817e468d3a4b56fb5d67d3472bc60f49cc25e86099b91f566ed1627e4f33b1ee037726e431af11c267bdd6d22518daf4489b6272f0d29304

  • SSDEEP

    49152:SvnI22SsaNYfdPBldt698dBcjHp2RJ6EbR3LoGdQRZTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjHp2RJ6O

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

other-little.gl.at.ply.gg:11758

Mutex

fbbc34bd-7320-405e-aebb-d4c666ee475f

Attributes
  • encryption_key

    FEA99DED4EFE826DE2850621FD7919E62525FD26

  • install_name

    DirectX111.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    DirectX

  • subdirectory

    SubDir

Targets

    • Target

      voidware_loader.exe

    • Size

      3.1MB

    • MD5

      d0d7ab7998eee34f17c5299b2e5369d8

    • SHA1

      6c1d3438adeb0b7f21be3c881be8fbee01b4e4f4

    • SHA256

      3864d360423959f1c229abd6db2a8b94c197910296c20661c4736102a388112f

    • SHA512

      fcec45df80bbe966817e468d3a4b56fb5d67d3472bc60f49cc25e86099b91f566ed1627e4f33b1ee037726e431af11c267bdd6d22518daf4489b6272f0d29304

    • SSDEEP

      49152:SvnI22SsaNYfdPBldt698dBcjHp2RJ6EbR3LoGdQRZTHHB72eh2NT:SvI22SsaNYfdPBldt6+dBcjHp2RJ6O

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks