Overview

overview

10

Static

static

3

MultiTool Setup.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MultiTool Setup.exe

  • Size

    2.7MB

  • Sample

    250328-xvbeea1r15

  • MD5

    c69d327438fde6e17346aa6aca31d925

  • SHA1

    8d029d5248d5c8213e08685b575d8e62bb1905cb

  • SHA256

    2beda275889a22bc7802f19347d682097aec3f7a3005f5c7fe263a3e625b3d8d

  • SHA512

    8e95612190b68f81726d5eb4686414c17be6de337aa0029db20e7ac322f57239aff0304f9e9ccd7059b1c1e7bf1bceb50cea598e1a7241a8d2e0afab6385d1ef

  • SSDEEP

    49152:BxXXm66OsQGuZjpAJ2EB45hN1nd3fmMDU8Sb0uRhEoy:BxHXsQG2jqq5hNSMYTRWoy

Score
10/10
quasardiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target

      MultiTool Setup.exe

    • Size

      2.7MB

    • MD5

      c69d327438fde6e17346aa6aca31d925

    • SHA1

      8d029d5248d5c8213e08685b575d8e62bb1905cb

    • SHA256

      2beda275889a22bc7802f19347d682097aec3f7a3005f5c7fe263a3e625b3d8d

    • SHA512

      8e95612190b68f81726d5eb4686414c17be6de337aa0029db20e7ac322f57239aff0304f9e9ccd7059b1c1e7bf1bceb50cea598e1a7241a8d2e0afab6385d1ef

    • SSDEEP

      49152:BxXXm66OsQGuZjpAJ2EB45hN1nd3fmMDU8Sb0uRhEoy:BxHXsQG2jqq5hNSMYTRWoy

    Score
    10/10
    quasardiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks