Overview

overview

10

Static

static

3

x6cfbe8907...65.exe

windows10-2004-x64

10

x6cfbe8907...65.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe
  • Size 5.2MB
  • Sample260602-d1tndscz3v
  • SHA256 6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
customerloaderquasarvps-86defense_evasiondownloaderexecutionloaderspywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.6.6

Botnet

  • vps-86

C2

  • 163.61.39.209:5669

Mutex

  • 4fd296c3-6a44-46fd-aeb0-b9b9530e8f29

Attributes
  • encryption_key

    63C89A087404DF5C2E4073DE97AD98A6817E3B5E

  • install_name

    .exe

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • reconnect_delay

    3000

Targets

    • Target
      x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe
    • Size 5.2MB
    • SHA256 6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    vps-86defense_evasiondownloaderexecutioncustomerloaderquasarloaderspywaretrojan

    • Family: Customer Loader

      Customer Loader is a downloader written in C#.

      downloaderloadercustomerloader

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • UAC bypass

      defense_evasiontrojan

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks