General

  • Target
    Client-built.exe
  • Size 3.1MB
  • Sample261109-reqw9scv5w
  • SHA256 07d456b5888d4676842f1a365c92c3a256a626437a435cf36121aaad927ae6e6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.1

Botnet
  • au88

C2
  • mm99.qpon:4782

  • mu88.uk.com:4782

  • koinslot168-f.cc:4782

  • pabwa.africa:4782

  • mu-88.sa.com:4782

  • awedi.africa:4782

  • slotslotbentley.cc:4782

  • mm88speed.com:4782

  • shio4d.com.co:4782

  • xgirls.in.net:4782

  • www.lifeatsea.in.net:4782

  • patur.in:4782

  • moviesda3.co:4782

  • restorepi.co:4782

  • alquimi.co:4782

  • boatique.co:4782

  • awakespace.co:4782

  • gambey.in:4782

  • thecoffeenomad.co:4782

  • koshikien.co:4782

Mutex
  • 273696bc-a6b2-4c7a-9e8a-e8ad984ce338

Attributes
  • encryption_key

    61D61573755A2E8791F777F44FE72A8C404B3F90

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    500

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target
      Client-built.exe
    • Size 3.1MB
    • SHA256 07d456b5888d4676842f1a365c92c3a256a626437a435cf36121aaad927ae6e6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

    • Quasar payload

    • Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks