General
- Target 18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71.bin
- Size 3.4MB
- Sample260519-kpsehsdt5j
- SHA256 18f33f1cb54fe347072cf720de5f022af69a7308cb98f0216345ec722c6f6e71
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
192.168.56.1:4040
Mutex
-
5bd7ca94-097d-4205-a10e-717acbfbcbd5
Attributes
-
encryption_key
A92F43739E112EA9AA3F4913FA647C65F0CFDA2C
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Targets
-
- Target test-main/file.ps1
- Size 7KB
- SHA256 e0052de5a9673f74be5a49fe13cae9b16b6f271972901b17236090667bb53d31
Score10/10Detects DonutLoader
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
Quasar payload
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target test-main/nigga.exe
- Size 1.2MB
- SHA256 71a7d0004e317f6787844347acdf4c910938820fd3f5476f6bd4bd7aeca34273
Score6/10Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.