quasar | 1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9 | Triage

Submit
Reports

Overview

overview

Static

static

1839c6634e...c9.exe

windows7-x64

1839c6634e...c9.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9
Size

3.1MB
Sample

240110-ltevnaeae6
MD5

946c9486e05a425d72306f00c1cdb973
SHA1

fd39eab29afcd8a57d9e29c576607b21f4f8251c
SHA256

1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9
SHA512

c7d6cf92c6c3314ae6f4ab22f65f2fe95f44af5acb116c3765cba6caf976c853f100113cdadce75f392e7a06c53ffd14143057d95bd340fb6939245f3cc19bda
SSDEEP

49152:CvOI22SsaNYfdPBldt698dBcjHDdGrdMfHLoGdETHHB72eh2NT:Cvj22SsaNYfdPBldt6+dBcjHDdGrA

Score

10^/10

quasar office04 spyware trojan

Static task

static1

office04 quasar

3 signatures

Behavioral task

behavioral1

Sample

1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9.exe

Resource

win7-20231215-en

quasar office04 spyware trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9.exe

Resource

win10v2004-20231215-en

quasar office04 spyware trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.106:8111

Mutex

87f23ae3-17d3-431d-bda5-307b65d46d77

Attributes

encryption_key
D912B92DAFB4D0C9D52F85801E609319CA9564F2
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9
- Size
  
  3.1MB
- MD5
  
  946c9486e05a425d72306f00c1cdb973
- SHA1
  
  fd39eab29afcd8a57d9e29c576607b21f4f8251c
- SHA256
  
  1839c6634e34e874a7b71b2601229ec69d3bbefbed652bff51596c7d212541c9
- SHA512
  
  c7d6cf92c6c3314ae6f4ab22f65f2fe95f44af5acb116c3765cba6caf976c853f100113cdadce75f392e7a06c53ffd14143057d95bd340fb6939245f3cc19bda
- SSDEEP
  
  49152:CvOI22SsaNYfdPBldt698dBcjHDdGrdMfHLoGdETHHB72eh2NT:Cvj22SsaNYfdPBldt6+dBcjHDdGrA
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasaroffice04spywaretrojan

behavioral2

quasaroffice04spywaretrojan

© 2018-2025

Terms | Privacy