Overview

overview

10

Static

static

10

SolaraB.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SolaraB.exe

  • Size

    3.1MB

  • Sample

    240705-nrzhdsxenl

  • MD5

    d108c0f1f8c55e42ab067537cdeeaa48

  • SHA1

    6983decbfae57b6f2fc2c47220b89f21781cff96

  • SHA256

    c3b85f4e668bdfce101e14bd55ca6a0f0192e5514285bb625e86c60f0a2cae23

  • SHA512

    45b486564aa6a1bcebf26f1e590d58a8a066c1a0bbb71e96c0ab857375bd225c39635fda2ae109aae12cf08535c76aa505d3dbc374694364c70937737034ea9a

  • SSDEEP

    49152:DvHI22SsaNYfdPBldt698dBcjH9ERJ6SbR3LoGdJjTHHB72eh2NT:Dvo22SsaNYfdPBldt6+dBcjH9ERJ6M

Score
10/10
quasarsolaraspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Solara

C2

review-lambda.gl.at.ply.gg:60595

Mutex

fb5df469-592e-42a2-af6e-b4d18d9bb819

Attributes
  • encryption_key

    5F525286F91E7CDC0AF8D2D67907DD091A941ED7

  • install_name

    Windows.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows

  • subdirectory

    Windows

Targets

    • Target

      SolaraB.exe

    • Size

      3.1MB

    • MD5

      d108c0f1f8c55e42ab067537cdeeaa48

    • SHA1

      6983decbfae57b6f2fc2c47220b89f21781cff96

    • SHA256

      c3b85f4e668bdfce101e14bd55ca6a0f0192e5514285bb625e86c60f0a2cae23

    • SHA512

      45b486564aa6a1bcebf26f1e590d58a8a066c1a0bbb71e96c0ab857375bd225c39635fda2ae109aae12cf08535c76aa505d3dbc374694364c70937737034ea9a

    • SSDEEP

      49152:DvHI22SsaNYfdPBldt698dBcjH9ERJ6SbR3LoGdJjTHHB72eh2NT:Dvo22SsaNYfdPBldt6+dBcjH9ERJ6M

    Score
    10/10
    quasarsolaraspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks