quasar | hxxps://files[.]fairu[.]cloud/qXfNk7

Resubmissions

20/02/2024, 23:03

240220-211cyagb4110

20/02/2024, 22:59

240220-2ygstagf3610

Sharing

Copy URL Twitter E-mail

General

Target
https://files.fairu.cloud/qXfNk7
Sample240220-211cyagb41

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

84.55.30.38:4782

Mutex

e752f5ea-ce47-447d-b629-c5a19ce021a7

Attributes

encryption_key
01184DD45C540059959B6C51315C651AB9926BB7
install_name
Epic Games.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Epic Games
subdirectory
SubDir

Targets

- Target
  https://files.fairu.cloud/qXfNk7
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar payload

Downloads MZ/PE file

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1