Overview

overview

10

Static

static

3

PrudaTweak.zip

windows11-21h2-x64

10

Resubmissions

26-01-2025 04:48

250126-fff8nssmbz 3

26-01-2025 04:44

250126-fdcgpsslez 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PrudaTweak.zip

  • Size

    10.6MB

  • Sample

    250126-fdcgpsslez

  • MD5

    c83d23532d6dd591ffc0d6fd75597dd7

  • SHA1

    06b3ad285f681700d5f9d43fed6a45e18368f7e8

  • SHA256

    67edbefe621aabd00b18f98816b872a87abeb3334e24f535732d02915aa82058

  • SHA512

    a0f49ce993f803200f493dbacc1bd9cb615fab63878ad80d00b77155cce2e48f9dcb706c4e3d2009ef47d7aedd9253da26a9ace83689718accf1dfdf3998f88b

  • SSDEEP

    196608:7saahvSji7LYOSIlr3vTPzz3Uh33HUxxqM3PBOfo6cakJrdfLjPQbUINfkotWep:7z0SjkL/lT7jUhUxMM3PB5JrVAbVyotL

Score
10/10
quasarprudabackendexecutionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

PrudaBackend

C2

45.131.108.110:4782

Mutex

8f8e6059-ac4f-4e47-8d62-3ce070083ecf

Attributes
  • encryption_key

    D82EC4913FC5B28DDFF5AC48635D190A9342C6BD

  • install_name

    update.exe

  • log_directory

    Logs

  • reconnect_delay

    2500

  • startup_key

    Runtime Broker.exe

Targets

    • Target

      PrudaTweak.zip

    • Size

      10.6MB

    • MD5

      c83d23532d6dd591ffc0d6fd75597dd7

    • SHA1

      06b3ad285f681700d5f9d43fed6a45e18368f7e8

    • SHA256

      67edbefe621aabd00b18f98816b872a87abeb3334e24f535732d02915aa82058

    • SHA512

      a0f49ce993f803200f493dbacc1bd9cb615fab63878ad80d00b77155cce2e48f9dcb706c4e3d2009ef47d7aedd9253da26a9ace83689718accf1dfdf3998f88b

    • SSDEEP

      196608:7saahvSji7LYOSIlr3vTPzz3Uh33HUxxqM3PBOfo6cakJrdfLjPQbUINfkotWep:7z0SjkL/lT7jUhUxMM3PB5JrVAbVyotL

    Score
    10/10
    quasarprudabackendexecutionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks