Overview

overview

10

Static

static

3

Payment010225.exe

windows7-x64

10

Payment010225.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment010225.exe

  • Size

    951KB

  • Sample

    250203-p5bh6atkcm

  • MD5

    b76d3e743d68ca1e3f04d641bfcc3ec7

  • SHA1

    d2d4fea6920a1a737199ce0fcac7c44adb5d7bd8

  • SHA256

    72209f1e92435b27f56db50ee9db7b82ebb11a6fb37ea5ade6cda13fc2c0d00c

  • SHA512

    c1e29917358740c56e9c83a0a5e8ea48d368806a0b71b2a240df9f5568cb7dc0d7b18e2959fe5b40d4ada2733594b6c17e705f6181c3a38eeaa1efd0ab24558b

  • SSDEEP

    24576:JPzFQtxBAb2JewjA/s5TqKnNiw0RALH0+XxryrSwg2J:1FC+2jpnNiRSXxqgM

Score
10/10
quasarstroydiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Stroy

C2

109.248.151.166:61537

Mutex

QSR_MUTEX_uHD8seWaFzpqqYxRLX

Attributes
  • encryption_key

    IR3AcRhjtuelpwNmTP7v

  • install_name

    Updater.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    Windows

Targets

    • Target

      Payment010225.exe

    • Size

      951KB

    • MD5

      b76d3e743d68ca1e3f04d641bfcc3ec7

    • SHA1

      d2d4fea6920a1a737199ce0fcac7c44adb5d7bd8

    • SHA256

      72209f1e92435b27f56db50ee9db7b82ebb11a6fb37ea5ade6cda13fc2c0d00c

    • SHA512

      c1e29917358740c56e9c83a0a5e8ea48d368806a0b71b2a240df9f5568cb7dc0d7b18e2959fe5b40d4ada2733594b6c17e705f6181c3a38eeaa1efd0ab24558b

    • SSDEEP

      24576:JPzFQtxBAb2JewjA/s5TqKnNiw0RALH0+XxryrSwg2J:1FC+2jpnNiRSXxqgM

    Score
    10/10
    quasarstroydiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks