Overview

overview

10

Static

static

10

eclipse ex...or.exe

windows7-x64

10

eclipse ex...or.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eclipseexecutor.zip

  • Size

    1.2MB

  • Sample

    250126-wd6njsyjgy

  • MD5

    ef28e032613646978bcb9219e5a490c9

  • SHA1

    539a9c11014f6d0341a44348ac059da0649dc138

  • SHA256

    78c3578aa894e56a27efeaa4daa26b2effd9e90a3ffaa32abea06f78e19ba735

  • SHA512

    9bfb694ed46ff4609e2a06600f1d643be478a0f744bb6c42c6fa292e7f13214b6b2ddf34b1253e74013155c53864473b50ad14f297aa8f1fcb047cdc42428536

  • SSDEEP

    24576:mdWpNNMHjlvOSQ57JhMIfDAFq46yQj1gq9zvJcX5O93LyPOQNb53XiFG:julk7JhMWsYWae/h53XiFG

Score
10/10
quasarmadespywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

made

C2

2001:569:7e70:6a00:c8f3:749c:278f:2c17:4782

Mutex

9d96368e-1352-46e3-8281-8f5eaf945edb

Attributes
  • encryption_key

    AF603C3CFA231D1BD841E315C27377C7E4A49333

  • install_name

    client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java startup

  • subdirectory

    SubDir

Targets

    • Target

      eclipse executor/eclipse executor.exe

    • Size

      3.1MB

    • MD5

      1512ffa41753d2f49de5b5296f5c174e

    • SHA1

      596412e03c09c60c822f6e0d12072e4cb861fa72

    • SHA256

      1df2e7dd996b5cfc2aea6b38548ef0375664ef618743bbcb623df319f9e48f3e

    • SHA512

      b07550d650a0960b0ffda941e0a71c4ce4630964cd74c58e2ae21225cceb1666c6d1de234a0f1802578f4a9afeca653cd1f295bd4d5a97d4afbd1ff0f5f582f5

    • SSDEEP

      49152:rv3I22SsaNYfdPBldt698dBcjHaFenk3xg2oGdaBTHHB72eh2NT:rv422SsaNYfdPBldt6+dBcjHasno

    Score
    10/10
    quasarmadespywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks