Overview

overview

10

Static

static

3

8f5375ff84...c6.exe

windows7-x64

10

8f5375ff84...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f5375ff845c22427e9d91f906ea19659adc6391e73569d16afbbed5d2c21fc6.exe

  • Size

    2.3MB

  • Sample

    250116-rnjjjstrat

  • MD5

    652a56aaba2ec480d2bddd1d0da85c19

  • SHA1

    93789dc672de1e8fc6b8fd6b17b881231d5d51ee

  • SHA256

    8f5375ff845c22427e9d91f906ea19659adc6391e73569d16afbbed5d2c21fc6

  • SHA512

    e692cbcfd9d8003df449cbb4d0fb27e86d7b78bb3223a8a0852f6932bfbc1d4668fda4bb5c89d9dc987977b2328c4af2c671aaebb85365737f95a1a99a42d351

  • SSDEEP

    49152:BBBVJ56thlDGrAErcdHrrlJ4vVtyBIzPrme7R2pvV7fxsSGXJVRqSVjMrR2:BLTQ1Erqcve+zPrJR2pN7ChVRJVjM12

Score
10/10
quasarzulaspcxdiscoveryspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    spri sdqs qrnn fpqi

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Extracted

Family

quasar

Version

1.4.1

Botnet

zulaspcx

C2

yeniceri99-24578.portmap.io:24578

Mutex

938aa95f-e3d4-483d-9217-ffafea133927

Attributes
  • encryption_key

    3BBA711AB673CCE3CC23338F52513D2C4D42AFEF

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    Windows

Targets

    • Target

      8f5375ff845c22427e9d91f906ea19659adc6391e73569d16afbbed5d2c21fc6.exe

    • Size

      2.3MB

    • MD5

      652a56aaba2ec480d2bddd1d0da85c19

    • SHA1

      93789dc672de1e8fc6b8fd6b17b881231d5d51ee

    • SHA256

      8f5375ff845c22427e9d91f906ea19659adc6391e73569d16afbbed5d2c21fc6

    • SHA512

      e692cbcfd9d8003df449cbb4d0fb27e86d7b78bb3223a8a0852f6932bfbc1d4668fda4bb5c89d9dc987977b2328c4af2c671aaebb85365737f95a1a99a42d351

    • SSDEEP

      49152:BBBVJ56thlDGrAErcdHrrlJ4vVtyBIzPrme7R2pvV7fxsSGXJVRqSVjMrR2:BLTQ1Erqcve+zPrJR2pN7ChVRJVjM12

    Score
    10/10
    quasarzulaspcxdiscoveryspywarestealertrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks