Overview

overview

10

Static

static

10

Client-built.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • Sample

    250123-qe95ga1kbs

  • MD5

    5ff1c7a31e2aeb8f5e998884bd5bcdd3

  • SHA1

    f02a220ced830d2ac29d42a3cc4c72a68b9f4068

  • SHA256

    45a7baa72cc53ffec5c9c7c8f4bef8ca6323f24a43c6f0baec29c70f3bbfce35

  • SHA512

    47ab416e032b917745acb7720411280803676ba63ef195a58786b3a0cba4803d88816e8ae740181e0af8ee1e7bd9dfe3aecfc26a806d19a6efc5e2c1ed4a38d2

  • SSDEEP

    49152:uvIt62XlaSFNWPjljiFa2RoUYI9P541vSLomdeTHHB72eh2NT:uvE62XlaSFNWPjljiFXRoUYI9P59

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.56.1:4782

Mutex

4933039f-7ad7-40a8-b70d-365558f6056c

Attributes
  • encryption_key

    EA7BEE3E368EF7D787AB8E01A4A119314D7B324C

  • install_name

    nigga.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    niggas

  • subdirectory

    SubDir

Targets

    • Target

      Client-built.exe

    • Size

      3.1MB

    • MD5

      5ff1c7a31e2aeb8f5e998884bd5bcdd3

    • SHA1

      f02a220ced830d2ac29d42a3cc4c72a68b9f4068

    • SHA256

      45a7baa72cc53ffec5c9c7c8f4bef8ca6323f24a43c6f0baec29c70f3bbfce35

    • SHA512

      47ab416e032b917745acb7720411280803676ba63ef195a58786b3a0cba4803d88816e8ae740181e0af8ee1e7bd9dfe3aecfc26a806d19a6efc5e2c1ed4a38d2

    • SSDEEP

      49152:uvIt62XlaSFNWPjljiFa2RoUYI9P541vSLomdeTHHB72eh2NT:uvE62XlaSFNWPjljiFXRoUYI9P59

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks