quasar | c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd | Triage

Submit
Reports

Overview

overview

Static

static

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd
Size

502KB
Sample

240426-hn9ajabc29
MD5

b3b85cb2f41722ce117f9413394eb11c
SHA1

7304546899bb48a3b04580327c49d71adee6a47b
SHA256

c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd
SHA512

60e1a3cdc04113cb36c52ce12444af862208b073042f80ad7c095f12b57e935435064cbda714eff2297ec6d27690812f6a11c63929e7a7a90a1c0bd3767538e3
SSDEEP

6144:1TEgdc0YNX7IxUpGREWdnkLmn9MnjM5EtqF+yw4PUcEBOb8F97UycTR3W:1TEgdfYWxUgkLZjl4YywHxpdUycdW

Score

10^/10

quasar gigabyte spyware trojan

Static task

static1

gigabyte quasar

3 signatures

Behavioral task

behavioral1

Sample

c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd.exe

Resource

win10v2004-20240226-en

quasar gigabyte spyware trojan

windows10-2004-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd.exe

Resource

win11-20240412-en

quasar gigabyte spyware trojan

windows11-21h2-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

gigabyte

C2

87.121.52.241:4000

Mutex

565c0b54-8fec-4eb0-a932-429f55a0cc82

Attributes

encryption_key
B000736BEBDF08FC1B6696200651882CF57E43E7
install_name
gigabyte.exe
log_directory
Logs
reconnect_delay
3000
startup_key
gigabyte update
subdirectory
SubDir

Targets

- Target
  
  c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd
- Size
  
  502KB
- MD5
  
  b3b85cb2f41722ce117f9413394eb11c
- SHA1
  
  7304546899bb48a3b04580327c49d71adee6a47b
- SHA256
  
  c39c6e705d47e5a860be8a42458cc536471d55fc5674526f7517fd972161e3cd
- SHA512
  
  60e1a3cdc04113cb36c52ce12444af862208b073042f80ad7c095f12b57e935435064cbda714eff2297ec6d27690812f6a11c63929e7a7a90a1c0bd3767538e3
- SSDEEP
  
  6144:1TEgdc0YNX7IxUpGREWdnkLmn9MnjM5EtqF+yw4PUcEBOb8F97UycTR3W:1TEgdfYWxUgkLZjl4YywHxpdUycdW
Score

10^/10

quasar gigabyte spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasargigabytespywaretrojan

behavioral2

quasargigabytespywaretrojan

© 2018-2024

Terms | Privacy