Overview

overview

10

Static

static

3

SynapseX.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SynapseX.exe

  • Size

    2.2MB

  • Sample

    240706-zpekzsscpl

  • MD5

    64f8181b0cafeb0cb231b82ebdca1cca

  • SHA1

    a49bd6450e5588a2d8b734329897053b02224ad5

  • SHA256

    56ac435655045823aa96a67bd5e9afa45d16f8bee8daff2f7d790d6c1c9b26ce

  • SHA512

    0ce9956d78364ead6c5f5ed958e77b61aeb500837541863d3154cc77dc4b3c77383fa4d6cbcf63d312e292ff7fc7c74a8098374d6c34caaa1dd3fd824f872bc4

  • SSDEEP

    49152:5soozm5VdW2rix+nO78vjp9X8j3vnUz04Z2YsF3:5DoznbxT78vjp9Mj/JA2L

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.174:4782

Mutex

0544130a-0a96-4695-b537-d74bab66d8c7

Attributes
  • encryption_key

    B4FC64153C81F311BB96F6A5E89311EA9CE3D1D5

  • install_name

    SynapseX Keyless.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft Security

  • subdirectory

    SubDir

Targets

    • Target

      SynapseX.exe

    • Size

      2.2MB

    • MD5

      64f8181b0cafeb0cb231b82ebdca1cca

    • SHA1

      a49bd6450e5588a2d8b734329897053b02224ad5

    • SHA256

      56ac435655045823aa96a67bd5e9afa45d16f8bee8daff2f7d790d6c1c9b26ce

    • SHA512

      0ce9956d78364ead6c5f5ed958e77b61aeb500837541863d3154cc77dc4b3c77383fa4d6cbcf63d312e292ff7fc7c74a8098374d6c34caaa1dd3fd824f872bc4

    • SSDEEP

      49152:5soozm5VdW2rix+nO78vjp9X8j3vnUz04Z2YsF3:5DoznbxT78vjp9Mj/JA2L

    Score
    10/10
    quasaroffice04spywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks