Overview

overview

10

Static

static

10

2b556da7af...32.exe

windows7-x64

10

2b556da7af...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2b556da7af4e05fdc5c0a47bbdcc999bc9f3f708f7aa88f07ed3083f88d45432

  • Size

    3.1MB

  • Sample

    250124-yf8a9svmf1

  • MD5

    7c1fd7240072a6a6f53d93f191d769f0

  • SHA1

    c0f3004513ea69aca854da4a740b176d04be8a35

  • SHA256

    2b556da7af4e05fdc5c0a47bbdcc999bc9f3f708f7aa88f07ed3083f88d45432

  • SHA512

    513f39e50c98b9bc22e7e97291df9577dd22c7a75405c86a0c49df8101b84ec67f96372d974c27dfd421bec3e8dc2b77984609136cda6e9ab39e0081ec84e493

  • SSDEEP

    49152:/v4uf2NUaNmwzPWlvdaKM7ZxTwkCC1JdLoGdeTHHB72eh2NT:/v3f2NUaNmwzPWlvdaB7ZxTwkCI

Score
10/10
quasarstinkydiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Stinky

C2

ef3243fsert34.ddns.net:47820

oj42315j346ng2134.myvnc.com:47820
Mutex

448b82a7-900f-48ac-b52b-73d8b9b1a9fa

Attributes
  • encryption_key

    7A23123B6E1E0CCDB27477C6C7654C7BE2FEDE54

  • install_name

    sru.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    xml

  • subdirectory

    sru

Targets

    • Target

      2b556da7af4e05fdc5c0a47bbdcc999bc9f3f708f7aa88f07ed3083f88d45432

    • Size

      3.1MB

    • MD5

      7c1fd7240072a6a6f53d93f191d769f0

    • SHA1

      c0f3004513ea69aca854da4a740b176d04be8a35

    • SHA256

      2b556da7af4e05fdc5c0a47bbdcc999bc9f3f708f7aa88f07ed3083f88d45432

    • SHA512

      513f39e50c98b9bc22e7e97291df9577dd22c7a75405c86a0c49df8101b84ec67f96372d974c27dfd421bec3e8dc2b77984609136cda6e9ab39e0081ec84e493

    • SSDEEP

      49152:/v4uf2NUaNmwzPWlvdaKM7ZxTwkCC1JdLoGdeTHHB72eh2NT:/v3f2NUaNmwzPWlvdaB7ZxTwkCI

    Score
    10/10
    quasarstinkydiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks