quasar | 440e8cb633be17b4b737685f46d66926ff9e5890b51001c9bf2c46b2ac938b58

General

Target
Routing details.zip
Size 8KB
Sample240320-y78fcaab52
SHA256 440e8cb633be17b4b737685f46d66926ff9e5890b51001c9bf2c46b2ac938b58
MD5 7d5d8ae9222082644db0212027b6efbf
SHA1 5a578b45354b80c05161db1a2f871c74af4863d5
SHA512 8566ecad98ee871ace711de5f545ebe282c7803d0ed3461c8092af31d25bae6e423aa95a915f239478a72b03bf6f4e6eb072b12fdbabb110feff8ba0217ac13d
SSDEEP 192:ok3lTMJ5JDGWqqqqqqfwwwwwc7ydEdswZdTdddGdds/dhdOuQdd7dswZdTdddGdl:d3A5dGMwwwwwuydEdTZdTdddGdds/dhH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://textbin.net/raw/ezjmofz3s6

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

crazydns.bumbleshrimp.com:7000

Mutex

1d11448c-a4d9-4fe0-a8b4-08159124ae39

Attributes

encryption_key
41386FD3E7B93BA09EAF2FA232A135070198910B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  Routing details.zip
- Size 8KB
- SHA256 440e8cb633be17b4b737685f46d66926ff9e5890b51001c9bf2c46b2ac938b58
- MD5 7d5d8ae9222082644db0212027b6efbf
- SHA1 5a578b45354b80c05161db1a2f871c74af4863d5
- SHA512 8566ecad98ee871ace711de5f545ebe282c7803d0ed3461c8092af31d25bae6e423aa95a915f239478a72b03bf6f4e6eb072b12fdbabb110feff8ba0217ac13d
- SSDEEP 192:ok3lTMJ5JDGWqqqqqqfwwwwwc7ydEdswZdTdddGdds/dhdOuQdd7dswZdTdddGdl:d3A5dGMwwwwwuydEdTZdTdddGdds/dhH
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Routing details.vbs
- Size 746KB
- SHA256 07bc70b67231b8d11d3b8f6da211fff0bb7ad9f47ee1d0ef882a47fa2a0ab30c
- MD5 02b7aafaf3609f054f864e144ce52179
- SHA1 82b8a24cc1a056f248602fbf37cf4fa45ee4be70
- SHA512 56ac99d8ad24a6c69f180d50dbb7244a11cde5a9c4d162ca556a80ba5730b2655be9522ab853a1af98ec565160348a639765f77c09521c5f4dd8b3779b5d642a
- SSDEEP 1536:HKtttttttttttttttttttttttttt3ggggggggggggggggggggggggggggggggggp:K
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Quasar RAT

Quasar payload

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4