Overview

overview

10

Static

static

1

J4MI2Tw.mp4

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    J4MI2Tw.mp4

  • Size

    96KB

  • Sample

    240701-s86p9asbjj

  • MD5

    66a981e94f170d69493557a2a9524042

  • SHA1

    2e62907251c5f094c00eff28ed706afd904e145b

  • SHA256

    7ed7740e62be65fc829f5f42088822e88c694f7215bfe3def89b2e195e3a6c6f

  • SHA512

    f46af770841d8137e13f8425388327a3dfea6fe058220169abf689f703984ad5dfffb7bddab2fa1720fefb0ac6048d864623c9e3e616e76087895cc04a540f7a

  • SSDEEP

    3072:wIu5D/DdbgXgrshci4vge+pjeVlxBkdCqys:CD7FujheYe+pYSos

Score
10/10
quasarloaderdiscoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Loader

C2

127.0.0.1:4782

Mutex

$Sxr-GV6wZsGZZMeZ3qfenc

Attributes
  • encryption_key

    Ra1DOofyRvoijluVcSIq

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      J4MI2Tw.mp4

    • Size

      96KB

    • MD5

      66a981e94f170d69493557a2a9524042

    • SHA1

      2e62907251c5f094c00eff28ed706afd904e145b

    • SHA256

      7ed7740e62be65fc829f5f42088822e88c694f7215bfe3def89b2e195e3a6c6f

    • SHA512

      f46af770841d8137e13f8425388327a3dfea6fe058220169abf689f703984ad5dfffb7bddab2fa1720fefb0ac6048d864623c9e3e616e76087895cc04a540f7a

    • SSDEEP

      3072:wIu5D/DdbgXgrshci4vge+pjeVlxBkdCqys:CD7FujheYe+pYSos

    Score
    10/10
    quasarloaderdiscoveryspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks