General

  • Target

    9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe

  • Size

    916KB

  • Sample

    250124-fazg3a1pdp

  • MD5

    bea723449eb145b6c4000bfca106e3ed

  • SHA1

    42bf0ff775020eabeecf4150b0129dd561dc0736

  • SHA256

    9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78

  • SHA512

    9b488266399b6e7aea71cde0eb7c23621b684e207f2cce1e4cec71da7122bda9cc3c51ef61d29a02f18c04feacbfa5e009a03d8ef50bac613b52e018a7c86954

  • SSDEEP

    24576:u3zSBJk4l/5b1nhD6g+0yQEuTLusJLK1lkloLXZ:azSBJk4l/5b1nhD6g+0yQEuRk1lkg

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Comquedinhaacoisaanda

C2

190.102.40.205:5552

Mutex

PfN9Ye1THuAjieZbW1

Attributes
  • encryption_key

    m4bU7sJJzbSU2TB27KbW

  • install_name

    Venom.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Targets

    • Target

      9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78.exe

    • Size

      916KB

    • MD5

      bea723449eb145b6c4000bfca106e3ed

    • SHA1

      42bf0ff775020eabeecf4150b0129dd561dc0736

    • SHA256

      9e7b3fcd73d20b2c92b8cfa21626afc9cdd34fd093b0760d0b22edd3d027db78

    • SHA512

      9b488266399b6e7aea71cde0eb7c23621b684e207f2cce1e4cec71da7122bda9cc3c51ef61d29a02f18c04feacbfa5e009a03d8ef50bac613b52e018a7c86954

    • SSDEEP

      24576:u3zSBJk4l/5b1nhD6g+0yQEuTLusJLK1lkloLXZ:azSBJk4l/5b1nhD6g+0yQEuRk1lkg

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar family

    • Quasar payload

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks