Overview

overview

10

Static

static

10

KAZZAK Nov...er.exe

windows7-x64

10

KAZZAK Nov...er.exe

windows10-2004-x64

10

KAZZAK Nov...NG.txt

windows7-x64

1

KAZZAK Nov...NG.txt

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KAZZAK Nova.rar

  • Size

    1.0MB

  • Sample

    250131-b1qkmayrfr

  • MD5

    e1d1ffda5b6298c0e50f24d1a802ff2c

  • SHA1

    2c37e889779eef7c795d5a32a640f68889a0d5ed

  • SHA256

    30adee2f7cba21cc4a48c262c26a34846c5f094182934402b6195da76b4b8f5e

  • SHA512

    2c36b9b79c7d763280568a3acf72d5e21c108a312a1e033393ab8546963da2113c2c3bb27ec3e01cbcd637b065f5d08b130c3c3516f98bfa4600a2cbfaa169b4

  • SSDEEP

    24576:Qc9pjbp14NUZqEqrN9532Wrzq5YJJiuEIAFx+60ztzSwliif5dw:PXpW6ZJqJn3ZrgiiD+60ztmwN5u

Score
10/10
quasaroffice04discoveryspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

kaziahlds-23371.portmap.io:23371

Mutex

04d20254-5898-4b4a-8396-e1aacfd3225f

Attributes
  • encryption_key

    1127B18519097512D1F8F01C3CC393354B9F8404

  • install_name

    Loader.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    KAZZAK

  • subdirectory

    SubDir

Targets

    • Target

      KAZZAK Nova/KAZZAK Nova/Installer.exe

    • Size

      3.1MB

    • MD5

      c85c392d4f402f6d1efe69a397874fc8

    • SHA1

      d7bf20fc60a832f2c101fb47133fde314c164427

    • SHA256

      e33a67ca41bd7f1dbe94489e953d2a6d720dccd5fb82d62353946a193be862eb

    • SHA512

      605c12a4140fb1a18f76112040704c9c41a7b78b887324b12852400b56ab1c7e20d1587dfdc9ed62de1480eecaeb0e5b6f845157637aeecc429bdd60a068c971

    • SSDEEP

      49152:3vrI22SsaNYfdPBldt698dBcjHZTRJ6VbR3LoGdkTHHB72eh2NT:3vU22SsaNYfdPBldt6+dBcjHZTRJ6n

    Score
    10/10
    quasaroffice04spywaretrojandiscoverystealer

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

    • Target

      KAZZAK Nova/KAZZAK Nova/READ BEFORE USING.txt

    • Size

      97B

    • MD5

      5b4e02cc47e36bb84246536f4651f715

    • SHA1

      3373d2c244f6834e7f5225fc3cde533e173c04a1

    • SHA256

      c4f8e3c9108534e45d67868ba1c7a621eb241f0cbbe2a1e74fe0d5b4727405b8

    • SHA512

      b40a4b3fae7b7dfc790f175c77dbfb4a099dee8c2ad53c1c8f2d37aba3b25a9306894f1eb3577b0301faca5ab3a7a77742d105f73248b0d32677fee0d2aa2ae7

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks