General

  • Target

    0ffa441a13f140ff08492899f44d4d30288f193e68a1affcc0d62e617d1532cd.exe

  • Size

    502KB

  • Sample

    250118-dj5z4a1per

  • MD5

    aebbee96c927750b5c6eec97940acc19

  • SHA1

    fea20780c2b137ecea31544aa089f67ba4672ffd

  • SHA256

    0ffa441a13f140ff08492899f44d4d30288f193e68a1affcc0d62e617d1532cd

  • SHA512

    8f865a6381329cfcf5715366de9a6cce6fbb83b02643b816ea78cfe8f31b5b67bea4bce0b25d181268c3637853137f2b866f407047a5d66575c90547ccdd9af0

  • SSDEEP

    6144:hTEgdc0Y2X7IxUpGREW8MIdTEDdKbDkQfocEiOb8F9rd9wkbIcTR3C:hTEgdfYXxUe2DkSpxwkbIcdC

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

93.177.102.208:1337

Mutex

b1f80fe6-27eb-4a1c-bb91-851d5cd8d500

Attributes
  • encryption_key

    9C554DBE5929DA2C3E389A9DF35A30153D68038C

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Targets

    • Target

      0ffa441a13f140ff08492899f44d4d30288f193e68a1affcc0d62e617d1532cd.exe

    • Size

      502KB

    • MD5

      aebbee96c927750b5c6eec97940acc19

    • SHA1

      fea20780c2b137ecea31544aa089f67ba4672ffd

    • SHA256

      0ffa441a13f140ff08492899f44d4d30288f193e68a1affcc0d62e617d1532cd

    • SHA512

      8f865a6381329cfcf5715366de9a6cce6fbb83b02643b816ea78cfe8f31b5b67bea4bce0b25d181268c3637853137f2b866f407047a5d66575c90547ccdd9af0

    • SSDEEP

      6144:hTEgdc0Y2X7IxUpGREW8MIdTEDdKbDkQfocEiOb8F9rd9wkbIcTR3C:hTEgdfYXxUe2DkSpxwkbIcdC

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks