quasar | 952d63d495d96b8fc4d1f2bb371bc679022a30df308d9655d65406f1ad60ccbe | Triage

Submit
Reports

Overview

overview

Static

static

952D63D495...D9.exe

windows7-x64

952D63D495...D9.exe

windows10-2004-x64

Sharing

General

Target

952D63D495D96B8FC4D1F2BB371BC679022A30DF308D9.exe
Size

528KB
Sample

230206-wlvw1sfb82
MD5

8116d1a5b75aad82c508ecd37b722860
SHA1

0d1841a568ae45caf0d87d8b488ea200c3e45c50
SHA256

952d63d495d96b8fc4d1f2bb371bc679022a30df308d9655d65406f1ad60ccbe
SHA512

0bce0443a1dbdb7fde964960cbf9414edd8e7b04cde162747b451e2e9079d9d96b8846819126b6de78d3add4466dfba293b0ee1e5ad585ec2b61d84aa33ade24
SSDEEP

6144:uTEgdc0YtebGbXOsA6j1RdhM1scdpQ2JXVPv1XcEn9b8F9XjO+EDbni9BycTR3S:uTEgdfYFA6LctT3CBO+8bi2cdS

Score

10^/10

quasar pure____1 spyware trojan

Static task

static1

pure____1 quasar

2 signatures

Behavioral task

behavioral1

Sample

952D63D495D96B8FC4D1F2BB371BC679022A30DF308D9.exe

Resource

win7-20221111-en

quasar pure____1 spyware trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

952D63D495D96B8FC4D1F2BB371BC679022A30DF308D9.exe

Resource

win10v2004-20221111-en

quasar pure____1 spyware trojan

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Pure____1

C2

sabifati.linkpc.net:4784

deli.mywire.org:4784

Mutex

3a359e52-00bd-4e3d-8201-985b53b0c176

Attributes

encryption_key
78BC50021362B61652204981B13FE17E053A03F1
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  952D63D495D96B8FC4D1F2BB371BC679022A30DF308D9.exe
- Size
  
  528KB
- MD5
  
  8116d1a5b75aad82c508ecd37b722860
- SHA1
  
  0d1841a568ae45caf0d87d8b488ea200c3e45c50
- SHA256
  
  952d63d495d96b8fc4d1f2bb371bc679022a30df308d9655d65406f1ad60ccbe
- SHA512
  
  0bce0443a1dbdb7fde964960cbf9414edd8e7b04cde162747b451e2e9079d9d96b8846819126b6de78d3add4466dfba293b0ee1e5ad585ec2b61d84aa33ade24
- SSDEEP
  
  6144:uTEgdc0YtebGbXOsA6j1RdhM1scdpQ2JXVPv1XcEn9b8F9XjO+EDbni9BycTR3S:uTEgdfYFA6LctT3CBO+8bi2cdS
Score

10^/10

quasar pure____1 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

pure____1quasar

behavioral1

quasarpure____1spywaretrojan

behavioral2

quasarpure____1spywaretrojan

© 2018-2024

Terms | Privacy