General
-
Target
https://krakenfiles.com/view/4blhrXan5g/file.html
-
Sample
250205-ztj19stqfl
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.168.128:4782
Mutex
dc364256-9033-4521-9896-694366634cc9
Attributes
-
encryption_key
ABDF5856149009AE87B822306C48E63D69768C92
-
install_name
Microsoft.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Microsoft
-
subdirectory
Microsoft
Targets
-
-
Target
https://krakenfiles.com/view/4blhrXan5g/file.html
Score10/10-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1