quasar | hxxps://github[.]com/TheParkourGame/theparkourgame

Resubmissions

06/04/2024, 14:32

240406-rwkrksda5510

06/04/2024, 14:28

240406-rs2wpach851

Sharing

Copy URL Twitter E-mail

General

Target
https://github.com/TheParkourGame/theparkourgame
Sample240406-rwkrksda55

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Rooftops And Alleys BETA

vpsquasar-41172.portmap.io:41172

Mutex

be6132b4-6882-45dd-a766-8cf384b45e98

Attributes

encryption_key
B5D210B3E27354B9DE74FFEB2E798BD013CE42E8
install_name
RooftopAndAlleys.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RooftopAndAlleys
subdirectory
SubDir

Targets

- Target
  https://github.com/TheParkourGame/theparkourgame
Score

10^/10

quasar rooftops and alleys beta spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Downloads MZ/PE file
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar payload

Downloads MZ/PE file

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1