Overview

overview

10

Static

static

1

startup_str_232.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    startup_str_232.bat

  • Size

    1.8MB

  • Sample

    250211-nghrwswnam

  • MD5

    d7c48a5173ca5bc25644c9799109c835

  • SHA1

    8845470e96cf21d7ff11961d3dd370787960dc22

  • SHA256

    39b6ba1d146867517cb7772b4a9665bf9139319dcb9e01ebb584ddab9daf54a8

  • SHA512

    e6a9e4d84ae1609ce511ba346faac33023e5ed3217a5c082be69ef18378ae3498153659aeeb506d2100c696cb50d329e6c2c24d4233c2b1f9442a5c59293a939

  • SSDEEP

    24576:va3qjALWb5fJ3LTbHrDt9uwqPffkE8s706cW4DNTfWihRFxwVyU6fmD7+P+XbCBe:y6ALi5fdLT1qPHlovRciV+VLkrWy4hx

Score
10/10
quasaroffice04executionspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.0.0

Botnet

Office04

C2

127.0.0.1:4782

Mutex

504956fd-d532-425c-9e82-cbe7902cf377

Attributes
  • encryption_key

    B8B9B325A830EF659FA4EC42DB8AA956BB46428A

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      startup_str_232.bat

    • Size

      1.8MB

    • MD5

      d7c48a5173ca5bc25644c9799109c835

    • SHA1

      8845470e96cf21d7ff11961d3dd370787960dc22

    • SHA256

      39b6ba1d146867517cb7772b4a9665bf9139319dcb9e01ebb584ddab9daf54a8

    • SHA512

      e6a9e4d84ae1609ce511ba346faac33023e5ed3217a5c082be69ef18378ae3498153659aeeb506d2100c696cb50d329e6c2c24d4233c2b1f9442a5c59293a939

    • SSDEEP

      24576:va3qjALWb5fJ3LTbHrDt9uwqPffkE8s706cW4DNTfWihRFxwVyU6fmD7+P+XbCBe:y6ALi5fdLT1qPHlovRciV+VLkrWy4hx

    Score
    10/10
    quasaroffice04executionspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks