quasar | fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10

Sharing

Copy URL Twitter E-mail

General

Target
e0bc13d8be65d524a6e7f23a0764b2ae.bin
Size 773KB
Sample240730-c26hxaxeqa
SHA256 fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10
MD5 e0bc13d8be65d524a6e7f23a0764b2ae
SHA1 451127b271d4b6e40010b90eb74dd8b9bf531d39
SHA512 a70ab7673c006d4ab1fd88b1a44460604fcca765340eb919c77b3ccaec39f85f562a6490ec9b46cd3957335b9a421f68ed710ed9ed3d2e14776f8410c1edb66a
SSDEEP 12288:aHPXfpduG1tAIKZHPXfpduG1tGEsHPXfpduG1tGEqJPb3D58uPHjSW:2PXfpZAIEPXfpZGJPXfpZGvAuPjSW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes

encryption_key
7A9A8376440E3257DB2B54403642F366A5FBE14A
install_name
Starter Module.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Starter Module
subdirectory
Modules

Targets

- Target
  DLL/kksvv.dll
- Size 576KB
- SHA256 3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
- MD5 7b92a6cb5d2cad407c457ab12d2b211d
- SHA1 e04020b3448fc6084fa31b7f791f22ff15e31328
- SHA512 b28740c1aca4f0f60a9e4a9ab5a0561af774d977ab6d42a7eea70c9e560c77c50be5d9d869f05d0435e2923f4f600219335d22425807ab23cbbcda75442c4b42
- SSDEEP 12288:RI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRvbQEKZm+jWodEEVhQ:RD89rxZCQEKZm+jWodEEPQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  DLL/msvcp140.dll
- Size 576KB
- SHA256 3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
- MD5 7b92a6cb5d2cad407c457ab12d2b211d
- SHA1 e04020b3448fc6084fa31b7f791f22ff15e31328
- SHA512 b28740c1aca4f0f60a9e4a9ab5a0561af774d977ab6d42a7eea70c9e560c77c50be5d9d869f05d0435e2923f4f600219335d22425807ab23cbbcda75442c4b42
- SSDEEP 12288:RI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRvbQEKZm+jWodEEVhQ:RD89rxZCQEKZm+jWodEEPQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  DLL/vcruntime.dll
- Size 576KB
- SHA256 3c6a772319fff3ee56d4cedbe332bb5c0c2f394714cf473c6cdf933754114784
- MD5 7b92a6cb5d2cad407c457ab12d2b211d
- SHA1 e04020b3448fc6084fa31b7f791f22ff15e31328
- SHA512 b28740c1aca4f0f60a9e4a9ab5a0561af774d977ab6d42a7eea70c9e560c77c50be5d9d869f05d0435e2923f4f600219335d22425807ab23cbbcda75442c4b42
- SSDEEP 12288:RI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRvbQEKZm+jWodEEVhQ:RD89rxZCQEKZm+jWodEEPQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  RedEngine.exe
- Size 502KB
- SHA256 67e35ca53e1ee18113207c2edf4b165ae9158cfed151e08bac627327f9c60f21
- MD5 7178d81c9afdabb202f31315f7eed7e2
- SHA1 527a063588b3e4d3acc04cf211d9b0df33f5ade2
- SHA512 80b770bd2d3541400386c4aa446da8840823864a62d73554dd62ea08d5e9596f2b737fa8046eb6fb892690d115eb928022cdb1d24f4f8d9cf2e449adfd0809a5
- SSDEEP 6144:9TEgdc0Y5XAGbgiIN2RSBTuYNzBlh/gKeFwQHocEhyb8F9ODx2cTR30:9TEgdfYVbg/uOiFwR12x2cd0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar training spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
- Drops file in System32 directory
behavioral7 behavioral8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar payload

Executes dropped EXE

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8