Overview

overview

10

Static

static

10

RoAim.exe

windows7-x64

10

RoAim.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RoAim.exe

  • Size

    3.1MB

  • Sample

    240706-phb66sybjp

  • MD5

    7b25339a424437e26ee5adddb0df81db

  • SHA1

    7ce44cc6eafba23227829a3ca82726a90dddc6c4

  • SHA256

    c115a07b5f78fb5145f60a84f12811011656d2b7f59c53a9160b3baddbb3431a

  • SHA512

    b0b5e9ff5025559679bb5dba5e58723a5e1777e685975e78b81bdaaa8f32f9c312ca3cb0d2e58d8bd1d94da5a37302875420dc9ce076f917960f55c8b919a350

  • SSDEEP

    49152:rvDI22SsaNYfdPBldt698dBcjHOv/IE2HTk/uV6oGdrETHHB72eh2NT:rv822SsaNYfdPBldt6+dBcjHOv/Ug7

Score
10/10
quasarroaimspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RoAim

C2

fdfsfsdfsfdfdsfs-59990.portmap.host::59990

Mutex

b3e3311a-deb4-40a6-b987-3b04c18fdac4

Attributes
  • encryption_key

    A0B08700DFA1C99CF0B737B2BEF8DABC798B5F02

  • install_name

    Java.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java

  • subdirectory

    Java

Targets

    • Target

      RoAim.exe

    • Size

      3.1MB

    • MD5

      7b25339a424437e26ee5adddb0df81db

    • SHA1

      7ce44cc6eafba23227829a3ca82726a90dddc6c4

    • SHA256

      c115a07b5f78fb5145f60a84f12811011656d2b7f59c53a9160b3baddbb3431a

    • SHA512

      b0b5e9ff5025559679bb5dba5e58723a5e1777e685975e78b81bdaaa8f32f9c312ca3cb0d2e58d8bd1d94da5a37302875420dc9ce076f917960f55c8b919a350

    • SSDEEP

      49152:rvDI22SsaNYfdPBldt698dBcjHOv/IE2HTk/uV6oGdrETHHB72eh2NT:rv822SsaNYfdPBldt6+dBcjHOv/Ug7

    Score
    10/10
    quasarroaimspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks