quasar | 412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a | Triage

Submit
Reports

Overview

overview

Static

static

baritone.exe

windows7-x64

baritone.exe

windows10-2004-x64

Sharing

General

Target

baritone.exe
Size

502KB
Sample

240529-r75acshg6x
MD5

bf1f011e9664823aeb1c386eeb9e5c90
SHA1

3a15112a330446b895811549a857d0d92763cf1a
SHA256

412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a
SHA512

584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44
SSDEEP

6144:NTEgdc0YxXAGbgiIN2RSBDuZnqUBlh/eKTFwQHocEAAb8F98IHsyzMcTR3u:NTEgdfYtbgvuIA5FwQj+HyzMcdu

Score

10^/10

quasar infectado spyware trojan

Static task

static1

infectado quasar

3 signatures

Behavioral task

behavioral1

Sample

baritone.exe

Resource

win7-20240221-en

quasar infectado spyware trojan

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

baritone.exe

Resource

win10v2004-20240426-en

quasar infectado spyware trojan

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

infectado

C2

elpepemanca.ddns.net:3440

192.168.0.14:3440

Mutex

2d163b2b-eaf2-4077-9c9f-de0b77680d93

Attributes

encryption_key
82A217D42F0FCA4A09032979DC25A2A7FD7E9698
install_name
explorer.exe
log_directory
crash_report
reconnect_delay
3000
startup_key
explorer.exe
subdirectory
windows

Targets

- Target
  
  baritone.exe
- Size
  
  502KB
- MD5
  
  bf1f011e9664823aeb1c386eeb9e5c90
- SHA1
  
  3a15112a330446b895811549a857d0d92763cf1a
- SHA256
  
  412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a
- SHA512
  
  584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44
- SSDEEP
  
  6144:NTEgdc0YxXAGbgiIN2RSBDuZnqUBlh/eKTFwQHocEAAb8F98IHsyzMcTR3u:NTEgdfYtbgvuIA5FwQj+HyzMcdu
Score

10^/10

quasar infectado spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

infectadoquasar

behavioral1

quasarinfectadospywaretrojan

behavioral2

quasarinfectadospywaretrojan

© 2018-2024

Terms | Privacy