Overview

overview

10

Static

static

10

Alantis.exe

windows7-x64

10

Alantis.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Alantis.exe

  • Size

    3.1MB

  • Sample

    250125-zpyc4a1pfm

  • MD5

    4383762bc2b4902a7a0a53de0f4fc86b

  • SHA1

    1fdf25af3d2ce3b006a7bfc0ebf697e4d3bc6781

  • SHA256

    d8a785ee093e2de80f62b04a8c2c2140cd71e4f759b0f8506b9b5e95b7a18797

  • SHA512

    8d3b1ebe39bfe0f8562f8d79371d2611dfe7bcd1faf23540393c7454c72dd0ff5b707fb192dbe5102ccdb911b2c753d0eb48b8da3e2916fa1e49e89b98cbf6be

  • SSDEEP

    49152:mvyI22SsaNYfdPBldt698dBcjHsLxNESEsk/iwLoGdhTTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHMxvO

Score
10/10
quasaruser 1spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

User 1

C2

98.7.107.133:4782

Mutex

23bbbc6e-4ec1-49b8-a1ff-368f79119ac2

Attributes
  • encryption_key

    52726EFCD3973C2418A54B3559AAEB44B57B8A6A

  • install_name

    Alantis.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Defender

  • subdirectory

    Roblox

Targets

    • Target

      Alantis.exe

    • Size

      3.1MB

    • MD5

      4383762bc2b4902a7a0a53de0f4fc86b

    • SHA1

      1fdf25af3d2ce3b006a7bfc0ebf697e4d3bc6781

    • SHA256

      d8a785ee093e2de80f62b04a8c2c2140cd71e4f759b0f8506b9b5e95b7a18797

    • SHA512

      8d3b1ebe39bfe0f8562f8d79371d2611dfe7bcd1faf23540393c7454c72dd0ff5b707fb192dbe5102ccdb911b2c753d0eb48b8da3e2916fa1e49e89b98cbf6be

    • SSDEEP

      49152:mvyI22SsaNYfdPBldt698dBcjHsLxNESEsk/iwLoGdhTTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHMxvO

    Score
    10/10
    quasaruser 1spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks