Overview

overview

10

Static

static

5

WindowsUpd...ce.exe

windows10-ltsc_2021-x64

10

WindowsUpd...ce.exe

windows11-21h2-x64

10

WindowsUpd...ce.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    WindowsUpdateService.exe
  • Size 1.4MB
  • Sample260702-2c59aacv7l
  • SHA256 d10d7dcbb30cd2cadaaba743fbbcff52b40a38fb0f8ce87530efa4677f1d8938
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
quasarronnie.vanillavpn.xyzexecutionpersistencespywaretrojanupx

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • ronnie.vanillavpn.xyz

C2

  • 51.161.98.215:1194

Mutex

  • f1bb65d9-0c68-4ce3-bdc1-12a7bc306fca

Attributes
  • encryption_key

    64CB7DD30B4A06DBD3BFE59846E2CA5D93571EA5

  • install_name

    WindowsUpdateService.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    WindowsDriverService

  • reconnect_delay

    67

  • startup_key

    WindowsUpdateService

  • subdirectory

    SYSWOW64

Targets

    • Target
      WindowsUpdateService.exe
    • Size 1.4MB
    • SHA256 d10d7dcbb30cd2cadaaba743fbbcff52b40a38fb0f8ce87530efa4677f1d8938
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    ronnie.vanillavpn.xyzexecutionquasarpersistencespywaretrojanupx

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks