Overview

overview

10

Static

static

10

P03SkzED.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P03SkzED.exe

  • Size

    1.9MB

  • Sample

    240630-1fhfyszbnj

  • MD5

    8a1c6ab6aeeec522d4d2d483543cb6ad

  • SHA1

    9133c7c95c6639c85f5880d97bfa4187905735b7

  • SHA256

    bd275a1f97d1691e394d81dd402c11aaa88cc8e723df7a6aaf57791fa6a6cdfa

  • SHA512

    86ca27ffa211847d772e2193540eb5da4ad8d6f8d62859cc86970b4053f6968521898ec63aafe4faaa30afbff513c12709bf46b917c5064de45398dab23fcd20

  • SSDEEP

    49152:gK2O5r4MM1BBE+qTSMBi9Rbpt/aaxJGC/0UhlHLomjqD:gK2O5rfMLByTSMBap9BxJG4zhlHU

Score
10/10
purelogstealerquasarmoveitpersistencespywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Moveit

C2

193.142.146.212:4782

Mutex

4b1cd0e7-d736-4aba-b4c8-067d2567b03d

Attributes
  • encryption_key

    E12B8859E2195F69A0C4E8D7025D91C844CB8B49

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      P03SkzED.exe

    • Size

      1.9MB

    • MD5

      8a1c6ab6aeeec522d4d2d483543cb6ad

    • SHA1

      9133c7c95c6639c85f5880d97bfa4187905735b7

    • SHA256

      bd275a1f97d1691e394d81dd402c11aaa88cc8e723df7a6aaf57791fa6a6cdfa

    • SHA512

      86ca27ffa211847d772e2193540eb5da4ad8d6f8d62859cc86970b4053f6968521898ec63aafe4faaa30afbff513c12709bf46b917c5064de45398dab23fcd20

    • SSDEEP

      49152:gK2O5r4MM1BBE+qTSMBi9Rbpt/aaxJGC/0UhlHLomjqD:gK2O5rfMLByTSMBap9BxJG4zhlHU

    Score
    10/10
    purelogstealerquasarmoveitpersistencespywarestealertrojan

    • PureLog Stealer

      PureLog Stealer is an infostealer written in C#.

      stealerpurelogstealer

    • PureLog Stealer payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks