Overview

overview

10

Static

static

10

Client-built10.exe

windows7-x64

10

Client-built10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built10.exe

  • Size

    3.1MB

  • Sample

    250327-rn459as1es

  • MD5

    8b09b710cf79da2dbb54ac8548eee0ad

  • SHA1

    b75efaae2675e05f51337bb1380c38b692074656

  • SHA256

    f47017465588d49383d9bb5071956e251d4c2ab024270f97b6ba35a3e6e7dec8

  • SHA512

    92e08ed6248f7e25e630dcfdfadeac8ada8a402def03da2c74c1d69455a8f0262648cb3b14195ea8b7cb7e1de8e510f9fdff897017db9babb675eebd6e07feb5

  • SSDEEP

    49152:WvUt62XlaSFNWPjljiFa2RoUYIxC11JuAoGd/THHB72eh2NT:WvI62XlaSFNWPjljiFXRoUYIxCF

Score
10/10
quasarkazekuspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

kazeku

C2

0.tcp.ap.ngrok.io:10431

Mutex

7fb11f4b-e530-407c-a46c-8834ab5c4f45

Attributes
  • encryption_key

    2E002E0BA1D95CECCDECD8F8B383C3F7C76A7FD7

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    kazeku

  • subdirectory

    kazeku

Targets

    • Target

      Client-built10.exe

    • Size

      3.1MB

    • MD5

      8b09b710cf79da2dbb54ac8548eee0ad

    • SHA1

      b75efaae2675e05f51337bb1380c38b692074656

    • SHA256

      f47017465588d49383d9bb5071956e251d4c2ab024270f97b6ba35a3e6e7dec8

    • SHA512

      92e08ed6248f7e25e630dcfdfadeac8ada8a402def03da2c74c1d69455a8f0262648cb3b14195ea8b7cb7e1de8e510f9fdff897017db9babb675eebd6e07feb5

    • SSDEEP

      49152:WvUt62XlaSFNWPjljiFa2RoUYIxC11JuAoGd/THHB72eh2NT:WvI62XlaSFNWPjljiFXRoUYIxCF

    Score
    10/10
    quasarkazekuspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks