Overview

overview

10

Static

static

10

gdrkkyjksf.exe

windows7-x64

10

gdrkkyjksf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gdrkkyjksf.exe

  • Size

    3.1MB

  • Sample

    250212-z5marsynfy

  • MD5

    c4f9f10a96ad4665cd156ce3d1a9e29c

  • SHA1

    10f32538070d3f615e1f2298f94f0250d846c8ed

  • SHA256

    19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010

  • SHA512

    fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482

  • SSDEEP

    49152:vvyt62XlaSFNWPjljiFa2RoUYIlxPEakWk/LCcoGdIS/THHB72eh2NT:vva62XlaSFNWPjljiFXRoUYIlxS5Y

Score
10/10
quasarminecrafterdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

minecrafter

C2

87.228.57.81:4782

Mutex

cf3988ab-2fd9-4544-a16f-9faa71eb5bac

Attributes
  • encryption_key

    19A0FAF8459F69650B5965C225752D425C429EEC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchoost.exe

  • subdirectory

    SubDir

Targets

    • Target

      gdrkkyjksf.exe

    • Size

      3.1MB

    • MD5

      c4f9f10a96ad4665cd156ce3d1a9e29c

    • SHA1

      10f32538070d3f615e1f2298f94f0250d846c8ed

    • SHA256

      19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010

    • SHA512

      fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482

    • SSDEEP

      49152:vvyt62XlaSFNWPjljiFa2RoUYIlxPEakWk/LCcoGdIS/THHB72eh2NT:vva62XlaSFNWPjljiFXRoUYIlxS5Y

    Score
    10/10
    quasarminecrafterspywaretrojandiscovery

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks