Overview

overview

10

Static

static

3

e6945b9b02...6N.exe

windows7-x64

10

e6945b9b02...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e6945b9b02bee97e03adcf9457ffaa4d175d03456345afb04e49d823d340bb86N.exe

  • Size

    2.3MB

  • Sample

    250116-knhtpasrfm

  • MD5

    6e556a65575209f5ea8b60d5c6a1d280

  • SHA1

    4659c6542283ae7e1522e650561987274d36a4a3

  • SHA256

    e6945b9b02bee97e03adcf9457ffaa4d175d03456345afb04e49d823d340bb86

  • SHA512

    90389c3cd37f6fca3a28d1543079355a6d1ad8ca113a065eeafaf822defa0b6ca5037655f2911d42965f3390cc401e834adfe3a1eda90f1b2a0b69c145e67f3f

  • SSDEEP

    49152:BBBVJ56thlDGrAErcdHrrlJ4vVtyBIzPrme7R2pvV7fxsSGXJVRqSVjMrR:BLTQ1Erqcve+zPrJR2pN7ChVRJVjM1

Score
10/10
quasarzulaspcxdiscoveryspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    spri sdqs qrnn fpqi

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.4.1

Botnet

zulaspcx

C2

yeniceri99-24578.portmap.io:24578

Mutex

938aa95f-e3d4-483d-9217-ffafea133927

Attributes
  • encryption_key

    3BBA711AB673CCE3CC23338F52513D2C4D42AFEF

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    Windows

Targets

    • Target

      e6945b9b02bee97e03adcf9457ffaa4d175d03456345afb04e49d823d340bb86N.exe

    • Size

      2.3MB

    • MD5

      6e556a65575209f5ea8b60d5c6a1d280

    • SHA1

      4659c6542283ae7e1522e650561987274d36a4a3

    • SHA256

      e6945b9b02bee97e03adcf9457ffaa4d175d03456345afb04e49d823d340bb86

    • SHA512

      90389c3cd37f6fca3a28d1543079355a6d1ad8ca113a065eeafaf822defa0b6ca5037655f2911d42965f3390cc401e834adfe3a1eda90f1b2a0b69c145e67f3f

    • SSDEEP

      49152:BBBVJ56thlDGrAErcdHrrlJ4vVtyBIzPrme7R2pvV7fxsSGXJVRqSVjMrR:BLTQ1Erqcve+zPrJR2pN7ChVRJVjM1

    Score
    10/10
    quasarzulaspcxdiscoveryspywarestealertrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks