quasar | 73399ca48340bd7a31da27d573966f23371fe4ea82625ee3b7ce2772386b9e04 | Triage

Sharing

General

Target

73399ca48340bd7a31da27d573966f23371fe4ea82625ee3b7ce2772386b9e04.exe
Size

3.6MB
Sample

240629-bvtebs1bql
MD5

78a7612603af19fb92d614af1e769f2a
SHA1

c032c86ab52a986d8fb85b4a2ffc4a41d2ec0a80
SHA256

73399ca48340bd7a31da27d573966f23371fe4ea82625ee3b7ce2772386b9e04
SHA512

5add757bf13e4e4bf404c7f3015caf0b6c22355ee47a0be11c0bdf7aa1e868b4c49aea1ce0aa899811733be63d96b60c90e410c5c3542500a7cf51dd28380781
SSDEEP

49152:LdbIKJzytEyM67fYoiJTwC/rMIqLwRjwVofSOtGhpGjyxqRlEBPPmgtPXVMNmIqK:RfgEy7755yrkwVwVWSqjePZ9Xg5cI

Score

10^/10

quasar newoffice spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

newoffice

C2

117.18.7.76:3782

Mutex

d908c8ed-ea88-484e-a3d2-dcbe66ac7cfc

Attributes

encryption_key
FD2DE574AF7E363A5304DF85B3475F93A948C103
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Client Startup
subdirectory
SubDir

Targets

- Target
  
  73399ca48340bd7a31da27d573966f23371fe4ea82625ee3b7ce2772386b9e04.exe
- Size
  
  3.6MB
- MD5
  
  78a7612603af19fb92d614af1e769f2a
- SHA1
  
  c032c86ab52a986d8fb85b4a2ffc4a41d2ec0a80
- SHA256
  
  73399ca48340bd7a31da27d573966f23371fe4ea82625ee3b7ce2772386b9e04
- SHA512
  
  5add757bf13e4e4bf404c7f3015caf0b6c22355ee47a0be11c0bdf7aa1e868b4c49aea1ce0aa899811733be63d96b60c90e410c5c3542500a7cf51dd28380781
- SSDEEP
  
  49152:LdbIKJzytEyM67fYoiJTwC/rMIqLwRjwVofSOtGhpGjyxqRlEBPPmgtPXVMNmIqK:RfgEy7755yrkwVwVWSqjePZ9Xg5cI
Score

10^/10

quasar newoffice spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

quasarnewofficespywaretrojan

behavioral2

quasarnewofficespywaretrojan