quasar | 10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104 | Triage

Submit
Reports

Overview

overview

Static

static

10dfcd3ab0...04.exe

windows7-x64

10dfcd3ab0...04.exe

windows10-2004-x64

Sharing

General

Target

10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
Size

3.1MB
Sample

240526-nagagsha58
MD5

700acd73a0f2f3e9372fe0e60f95576f
SHA1

efc3b03207b3e5a999d772fd7c11fb5b69977ebc
SHA256

10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
SHA512

a390e1b463d658beb17d9bc21e9e77f00e1dbe6dd0fc134ba682343d3a90c5a6535999aebafd1e2bad5bc319fa92072bb5efabff49878bd06d1cfee030a9db75
SSDEEP

49152:3vGlL26AaNeWgPhlmVqvMQ7XSKpJxNESE7k/iTLoGdoPTHHB72eh2NT:3vGL26AaNeWgPhlmVqkQ7XSKHx+f4

Score

10^/10

quasar office04 spyware trojan

Static task

static1

office04 quasar

3 signatures

Behavioral task

behavioral1

Sample

10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104.exe

Resource

win7-20240221-en

quasar office04 spyware trojan

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104.exe

Resource

win10v2004-20240508-en

quasar office04 spyware trojan

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

bin-inspections.gl.at.ply.gg:64055

Mutex

536deaa9-57d2-448a-ae01-b604426d7fa6

Attributes

encryption_key
DBB529B3F56F6D23695F8D7AC9BA28484A0D6D0F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
- Size
  
  3.1MB
- MD5
  
  700acd73a0f2f3e9372fe0e60f95576f
- SHA1
  
  efc3b03207b3e5a999d772fd7c11fb5b69977ebc
- SHA256
  
  10dfcd3ab03dcecb05d6f4b28dbd7a4070341783b8f5453b9af3bc6b9b77a104
- SHA512
  
  a390e1b463d658beb17d9bc21e9e77f00e1dbe6dd0fc134ba682343d3a90c5a6535999aebafd1e2bad5bc319fa92072bb5efabff49878bd06d1cfee030a9db75
- SSDEEP
  
  49152:3vGlL26AaNeWgPhlmVqvMQ7XSKpJxNESE7k/iTLoGdoPTHHB72eh2NT:3vGL26AaNeWgPhlmVqkQ7XSKHx+f4
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

quasaroffice04spywaretrojan

behavioral2

quasaroffice04spywaretrojan

© 2018-2024

Terms | Privacy