Overview

overview

10

Static

static

3

Captura de...GO.exe

windows7-x64

10

Captura de...GO.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    31012025_0116_Captura de Pantalla de PAGO.exe.iso

  • Size

    1.5MB

  • Sample

    250131-bmx3jsxjbv

  • MD5

    de9f0391377ad4dfb2cb4c4067137e72

  • SHA1

    ef616a1446513868f9b3dceb8f15112bf2227458

  • SHA256

    dc3ca1c97eb30f5be34ee7c76f6d3121659e314b8104d283c829f1a30f3b9796

  • SHA512

    626e80e3939abe9a871cb5fb1f9021f616dab0ff44f218739c2f036066110d1252330f8ae7555399e0b7e2bfa477f28667cc438b6f6f747c97e84808339fd2d7

  • SSDEEP

    24576:BRejzEhR4yfC6j7S9beD5M/+DnY7YpVbi2:BRej4hWYCO7S9beDW8nhpV+

Score
10/10
quasarstroydiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Stroy

C2

109.248.151.166:61537

Mutex

QSR_MUTEX_uHD8seWaFzpqqYxRLX

Attributes
  • encryption_key

    IR3AcRhjtuelpwNmTP7v

  • install_name

    Updater.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    Windows

Targets

    • Target

      Captura de Pantalla de PAGO.exe

    • Size

      946KB

    • MD5

      c7a177d2b04341c5e21ca7cf9f6000db

    • SHA1

      828a9d4041466f2e2f76b6ffcf641ac3814e7156

    • SHA256

      745b2a241f10dabbb5acd2abeb3c3b2df7ba525e4fae03e9de11efe5adb082d3

    • SHA512

      c07564d27f7c18264eb8145c20f3bb62da6e3e05b66836341a19ca0a2f6a889651a43357c15b618b0b578c9a0458ca6dc6aecf968404fea17f7865758c225bb5

    • SSDEEP

      24576:XRejzEhR4yfC6j7S9beD5M/+DnY7YpVbi2y:XRej4hWYCO7S9beDW8nhpV+7

    Score
    10/10
    quasarstroydiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks