quasar | ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9

General

Target
d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
Size 1.4MB
Sample240404-mntbjadb85
SHA256 ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9
MD5 d1ba7baf72077fb7d02f44c9f9b8f7ae
SHA1 0350cd5db239fb09ec4f30bed172551e410a76d4
SHA512 f77a5df3ac6b9abe21c815a2ae0ea977a5b68cfe764dc2d081704766519b9c75b2943ab50145e8896b64e4a855ba99ea907b6d28ac8047975d19f68a48c87eae
SSDEEP 24576:jfL1G/8dALL9ZvVby0ko+aUTVLHqsBjXeUlw56+Vk0/Zu9EhXIQ6Qjo0e4:L00AF3y0V+DBLJXJWVkYMK1Xjo54
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

crypt test

C2

217.63.234.90:1313
127.0.0.1:1313

Mutex

da99a14a-4271-45bb-8160-64267493c2c9

Attributes

encryption_key
6B0D9CDFBF22251A89F554E059B7463C8CDE0F0C
install_name
explorer.exe
log_directory
Logs50spread
reconnect_delay
5000
startup_key
svchost.exe
subdirectory
Directory

Targets

- Target
  d1ba7baf72077fb7d02f44c9f9b8f7ae.exe
- Size 1.4MB
- SHA256 ba78571683994ac10261134dab60e6e98dd417a417ff32aac59fe461e4e3ccd9
- MD5 d1ba7baf72077fb7d02f44c9f9b8f7ae
- SHA1 0350cd5db239fb09ec4f30bed172551e410a76d4
- SHA512 f77a5df3ac6b9abe21c815a2ae0ea977a5b68cfe764dc2d081704766519b9c75b2943ab50145e8896b64e4a855ba99ea907b6d28ac8047975d19f68a48c87eae
- SSDEEP 24576:jfL1G/8dALL9ZvVby0ko+aUTVLHqsBjXeUlw56+Vk0/Zu9EhXIQ6Qjo0e4:L00AF3y0V+DBLJXJWVkYMK1Xjo54
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar crypt test spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  ⠨/start.vbs
- Size 231B
- SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
- MD5 abe1dd23ab4c11aae54f1898c780c0b5
- SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
- SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  ⠨/temp.bat
- Size 1.7MB
- SHA256 606b19bc9f1ea92ac77deb5f1483854b38fedec0e3b6ed4406a665c556e05f7f
- MD5 b09a7a33e4538d30ca1619ed64d69b0e
- SHA1 e98259cdd53cb078ba4dc361534c08a1c4af2104
- SHA512 0a4eebdbf92ece0bf4abddd231cb5851eb7d6ccc1e4220c5c01811c0ec0b7627985badbf0828df361cf6117e2845951989b50246756f34c2f84a755353bc4ff9
- SSDEEP 24576:2kWFUNdypkoPw8W5ot17PQmQYdYc750hUSofNp647TVNPN3NyR90HKk5zxMAAWYv:GpY5orPxL5gyNHfG9gvMlW3SOQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar payload

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6