Overview

overview

10

Static

static

10

c973b6a179...2e.exe

windows7-x64

10

c973b6a179...2e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a717705a7797e35b6f5af62ffe43abb.bin

  • Size

    1.2MB

  • Sample

    250312-bcw3haswb1

  • MD5

    9f65f14a0750e65f99f65a62ac9472ec

  • SHA1

    3f10497d9e0f865dbc16c74cfb74bdfbf47f23c4

  • SHA256

    59aadef5bc9181b1849f339e10498f28825a0e5a9b914b2f774b70d2a6ff30a3

  • SHA512

    27ddcb71da2a729094dfdf96b278f170c9f744d2f1fc89279b4098d5049e9821708bf0b607b058145267dceff93fa0f11b4460cf195b0fe2be950de5bee8cbaf

  • SSDEEP

    24576:OJteucqnAGtHdzTfe/b17vY2TAQkyIxXU17HtEMF5Hr3:OJPBAwAh9TAQkyF1HGMvL3

Score
10/10
latentbotquasarhugrixdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Hugrix

C2

prxprodquasar.zapto.org:4782

Mutex

ad6032ec-a1ba-49fe-a6c9-21a847436cda

Attributes
  • encryption_key

    7AB142AC063BEB01BE33EE315E2D0BBA3E071A0B

  • install_name

    JavaUpdater.exe

  • log_directory

    JavaInstallLogs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    Java

Extracted

Family

latentbot

C2

prxprodquasar.zapto.org

Targets

    • Target

      c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e.exe

    • Size

      3.2MB

    • MD5

      0a717705a7797e35b6f5af62ffe43abb

    • SHA1

      4c823754c6cebe13ae0aec7ba874318f20445145

    • SHA256

      c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e

    • SHA512

      75d39a3fbbf3b6289330aab45471d497dec51d076dc96bf29b0bc526154bb9502745f08aee14624bca8c7b0f2c5822e2f81a8b959cd8348457015b06a2fe9ead

    • SSDEEP

      98304:zvr62XlaSFNWPjljiFXRoUYITrUCgLEEa1:75ZY2gLEEa1

    Score
    10/10
    latentbotquasarhugrixdiscoveryspywaretrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Latentbot family

      latentbot

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.