quasar | c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005a14cb91d2a9e4a2e90c

General

Target
c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe
Size 1.4MB
Sample240408-tf7yaadd43
SHA256 c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005a14cb91d2a9e4a2e90c
MD5 3d79dc4561f767cb36d606b183a935a1
SHA1 d6b8393cce26a6fe81e2764a82a076f933616032
SHA512 cbec0ddc9a54935ea6818b98fb27c0f4fe086b9ce19915a46175d044b2663d10cff583e595accca353fbea9cb34fe197485c05895768753e1fe6e34c6845dff1
SSDEEP 24576:xfL5njMnY25GYQ2RgV/8XZaELBHQ08HYPRNr+d6zr06jqEq/aZXvqcy3k+D:99gYVWgV0XZpHQ0x+0zrzuYCcy0E
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Quacks

C2

51.79.171.174:1337

Mutex

1a18c2f3-8977-4396-a2c1-ca02ae5f16bc

Attributes

encryption_key
CFB4F4CA022C9B6355A56391E851519D74D8996A
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005.exe
- Size 1.4MB
- SHA256 c1b6079cad447af00ffaaed62cc9a2e0af0ca6e5ab005a14cb91d2a9e4a2e90c
- MD5 3d79dc4561f767cb36d606b183a935a1
- SHA1 d6b8393cce26a6fe81e2764a82a076f933616032
- SHA512 cbec0ddc9a54935ea6818b98fb27c0f4fe086b9ce19915a46175d044b2663d10cff583e595accca353fbea9cb34fe197485c05895768753e1fe6e34c6845dff1
- SSDEEP 24576:xfL5njMnY25GYQ2RgV/8XZaELBHQ08HYPRNr+d6zr06jqEq/aZXvqcy3k+D:99gYVWgV0XZpHQ0x+0zrzuYCcy0E
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar quacks spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  ⠨/start.vbs
- Size 231B
- SHA256 89054e19532a9a62ca3403a8899495bf6f06557ff886b475a04227eb8aba7b12
- MD5 abe1dd23ab4c11aae54f1898c780c0b5
- SHA1 bb2f974b3e0af2baa40920b475582bfd4fb28001
- SHA512 e9ec437a32301078ea69ce2f36dadab68315d5e56d94c4d579d3409ccbe0c9e00c3aed7baa0fa6d656fb8ed23213f4c01fb2d108c1a0ed11c58c76cd00f9a99d
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  ⠨/temp.bat
- Size 1.7MB
- SHA256 64ef06afc91c79a5e16405310c059da3913188c1335b55de259cfc86289d5c82
- MD5 bd9b4fe6f3a5032efa5e4f5901178f1c
- SHA1 03c4ecbce621c5084e1ee53a2bb653622e0c5816
- SHA512 92c652102db95e6add8d2468f1b66010a9c1edd7c064a4408c2a546e1a21e96c318ce19451363e96fbec90e4dea7df483265e8e46a29bf4433651e2b0fea2ec2
- SSDEEP 24576:zCehnZTr2mjv285Xa3jn+Bu1IXM7oKQbsVzCM+RoXhBaOQIQOHcm+WK1gqqTs8Pj:fZTZT2W8j+M4MWfom/1YqS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar payload

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6