quasar | 6dace0bce0139f7a90be79aaa73a97df7903fc31ddbed4ba16a7712e0d20a9d7

General

Target

2002017386_001B203150123110000107_TAXINVOICE.xlsm
Size

42KB
Sample

230127-fjn3page26
MD5

9567cc095b840a0156939bd14bd60d1b
SHA1

bc066fb87caf1ea2dd5e710210a40371f83945b5
SHA256

6dace0bce0139f7a90be79aaa73a97df7903fc31ddbed4ba16a7712e0d20a9d7
SHA512

434558080df7752ee37bf738f3e73abff7f1f19c43dd9f99f7d5623caedcb9fd70c798922798d0b00ee23bf8b824ce5c972602cb96f8bb7e9899e8bcd7554be6
SSDEEP

768:RZvptTvBssn/24oBIJYfTH+niSpFvDHz0v+nW6FFiKk/fGqtCAwgRy+nQ+1N:bvHvBTfoG1BnTz0v+hFFi3/eqE5gzQ+f

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

SUCCESS

C2

41.185.97.216:4782

Mutex

MUTEX_QAxMFzrXWG2cbIHPGK

Attributes

encryption_key
JRUJdiIOmPJ5LlsFaVs9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
cmd
subdirectory
SubDir

Targets

- Target
  
  2002017386_001B203150123110000107_TAXINVOICE.xlsm
- Size
  
  42KB
- MD5
  
  9567cc095b840a0156939bd14bd60d1b
- SHA1
  
  bc066fb87caf1ea2dd5e710210a40371f83945b5
- SHA256
  
  6dace0bce0139f7a90be79aaa73a97df7903fc31ddbed4ba16a7712e0d20a9d7
- SHA512
  
  434558080df7752ee37bf738f3e73abff7f1f19c43dd9f99f7d5623caedcb9fd70c798922798d0b00ee23bf8b824ce5c972602cb96f8bb7e9899e8bcd7554be6
- SSDEEP
  
  768:RZvptTvBssn/24oBIJYfTH+niSpFvDHz0v+nW6FFiKk/fGqtCAwgRy+nQ+1N:bvHvBTfoG1BnTz0v+hFFi3/eqE5gzQ+f
Score

10^/10

quasar warzonerat success collection evasion infostealer persistence rat spyware stealer trojan upx
- Modifies WinLogon for persistence
  persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets DLL path for service in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2