General
-
Target
Client-built.exe
-
Size
288KB
-
Sample
240629-2zwy5ayekg
-
MD5
612513b20674942d2bcf4d0732e0b726
-
SHA1
26e71467d042ccc4ade033a000a1febac73170d7
-
SHA256
d0b01d8716df6a5635967566bf4f89daba958ae5689561e956d33f644be14d38
-
SHA512
ce278631bb21322df5daf5a7b1a8296c2030a1708ec4367e444f9c65138b6f345e79d45138ec24f616b9da94150e82ad4ec3bbcee4282501c7eee568cc50ed8a
-
SSDEEP
6144:6KJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkUC:pzCGL69zVGkllbkp
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
quasar
1.4.0.0
Office04
Ratrat2-53904.portmap.host:53904
KvGe0Q07bhebNCip9c
-
encryption_key
urBKaVmkbLbNrQbAkgkI
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Steam
-
subdirectory
SubDir
Targets
-
-
Target
Client-built.exe
-
Size
288KB
-
MD5
612513b20674942d2bcf4d0732e0b726
-
SHA1
26e71467d042ccc4ade033a000a1febac73170d7
-
SHA256
d0b01d8716df6a5635967566bf4f89daba958ae5689561e956d33f644be14d38
-
SHA512
ce278631bb21322df5daf5a7b1a8296c2030a1708ec4367e444f9c65138b6f345e79d45138ec24f616b9da94150e82ad4ec3bbcee4282501c7eee568cc50ed8a
-
SSDEEP
6144:6KJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkUC:pzCGL69zVGkllbkp
Score10/10-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1