Overview

overview

10

Static

static

10

keysercheetos.exe

windows7-x64

10

keysercheetos.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    keysercracked.rar

  • Size

    1.0MB

  • Sample

    250328-tz8c6azqv5

  • MD5

    af287f435ab3ef603b3466139b9744f2

  • SHA1

    f045e427fe709dfbf9a5c7cd31ad63bac744e80d

  • SHA256

    daf48dfcff237bc1883b9b0005b0a3ea92880e0d561ad4127de2076542252aa5

  • SHA512

    d433daa4426d43027f2e45444e1ea595d8475381b8e157c9a70fa954844b4bb6453cef918c486043e742388528541591cbf2f0a65604206fa1035f6216f5d4af

  • SSDEEP

    24576:tTDRFI8lU6K30gR+eXJETFMAg5z/xUyvjW/A:tTD48lU6K3+OJEBMAgp/xUy7WY

Score
10/10
quasardaddyspooferv1.4spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

daddyspooferv1.4

C2

192.168.56.1:4782

192.168.56.1:4781

chris1212-43098.portmap.host:4782

chris1212-43098.portmap.host:43098
Mutex

66be076a-c9c1-4ea0-a5c1-d0257b4d87ee

Attributes
  • encryption_key

    D0FBA107AD203B610615E444B23834F88CB58A1D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    clienthost.exe

Targets

    • Target

      keysercheetos.exe

    • Size

      3.1MB

    • MD5

      b84554678c815444402cece204dff1cf

    • SHA1

      d33aa8abde2e1d365db0dfdb3d0d2cdde1703b52

    • SHA256

      0cca1529d1dc1550f12746113f6749ea5a943624b8e3f3e1116e53c65de9f6b5

    • SHA512

      6cfd847c76c68dea1afbf61025594965f4a943547031ba3ff96d2698c5ba126fc47b103dbdc10b80b038cb6ad6dc8804c9dcb76977a52adb863080a6b0ce1a1b

    • SSDEEP

      49152:QvVL82kyaNnwxPlllSWxc9LpQXz3spdpQLoGdiTHHB72eh2NT:Qvl82kyaNnwxPlllSWa9LpQXLsU

    Score
    10/10
    quasardaddyspooferv1.4spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks