Overview

overview

10

Static

static

3

20250121-0...om.exe

windows7-x64

10

20250121-0...om.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20250121-004Especificacinrequerida.pdf62KB.com.exe

  • Size

    3.7MB

  • Sample

    250121-jpnkwstmgm

  • MD5

    570c14adf8743c7db308309f24e2955a

  • SHA1

    217b4e17f050d5ea71dd981bb832df4f1a472442

  • SHA256

    7300535ef26158bdb916366b717390fc36eb570473ed7805c18b101367c68af5

  • SHA512

    1107773a533e0d8df7db216ad5a2eddb84463ccdf30adf67e7df5fc9d7681a2c9eafbaf5a62db4eef7e57cb120b64260e96030d9cb7fbd585750a43337e62fd0

  • SSDEEP

    98304:efD1osXo7ZuEziszaWStvyaNkKk52ypcW:efchziszcvya852M

Score
10/10
quasares codediscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ES CODE

C2

twart.myfirewall.org:9792

rency.ydns.eu:5287

wqo9.firewall-gateway.de:8841

code1.ydns.eu:5287

wqo9.firewall-gateway.de:9792
Mutex

025351e291-5d1041-4fa37-932c7-8L69aeiQec514992

Attributes
  • encryption_key

    3145298725BA5E0DD56E87FFE3F8898EA81E6EDA

  • install_name

    Excelworkbook.exe

  • log_directory

    Logs

  • reconnect_delay

    6000

  • startup_key

    pdfdocument

  • subdirectory

    SubDir

Targets

    • Target

      20250121-004Especificacinrequerida.pdf62KB.com.exe

    • Size

      3.7MB

    • MD5

      570c14adf8743c7db308309f24e2955a

    • SHA1

      217b4e17f050d5ea71dd981bb832df4f1a472442

    • SHA256

      7300535ef26158bdb916366b717390fc36eb570473ed7805c18b101367c68af5

    • SHA512

      1107773a533e0d8df7db216ad5a2eddb84463ccdf30adf67e7df5fc9d7681a2c9eafbaf5a62db4eef7e57cb120b64260e96030d9cb7fbd585750a43337e62fd0

    • SSDEEP

      98304:efD1osXo7ZuEziszaWStvyaNkKk52ypcW:efchziszcvya852M

    Score
    10/10
    quasares codediscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks