quasar | de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336 | Triage

Sharing

General

Target

SynapseXBootstrapper.exe
Size

3.1MB
Sample

240528-3gqvtsgh5x
MD5

9434a1822088cedbce057d280c235864
SHA1

c09173a18e5ae2d9d38bd4d3d196adf1423f924e
SHA256

de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336
SHA512

7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632
SSDEEP

49152:PvnI22SsaNYfdPBldt698dBcjHHeJ/uBx3ioGdyTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjH4/X

Score

10^/10

quasar windows update spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

C2

skbidiooiilet-31205.portmap.host:31205

Mutex

b2f09b33-2e5b-4ffa-afbf-3f1aaed274a6

Attributes

encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
install_name
Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
Windows Update

Targets

- Target
  
  SynapseXBootstrapper.exe
- Size
  
  3.1MB
- MD5
  
  9434a1822088cedbce057d280c235864
- SHA1
  
  c09173a18e5ae2d9d38bd4d3d196adf1423f924e
- SHA256
  
  de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336
- SHA512
  
  7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632
- SSDEEP
  
  49152:PvnI22SsaNYfdPBldt698dBcjHHeJ/uBx3ioGdyTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjH4/X
Score

10^/10

quasar windows update spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

windows updatequasar

behavioral1

quasarwindows updatespywaretrojan