quasar | 671d1bd3c3281935daaf31d5f9265b019509371442c2e8eba4f3626dec2418fe

Sharing

Copy URL Twitter E-mail

General

Target
671d1bd3c3281935daaf31d5f9265b019509371442c2e8eba4f3626dec2418fe
Size 8.2MB
Sample240813-xt4dsswbnk
SHA256 671d1bd3c3281935daaf31d5f9265b019509371442c2e8eba4f3626dec2418fe
MD5 5a34a75dfe24d76e957070a5ad03b99a
SHA1 d75523ef6154fadceeeb37450e63e115d1bf5985
SHA512 1964db71dfc00a4ff5bbb794044ba6487bc345fdbb909354c098c77b1a6049f8f80d2a768b0e223e2cb47618409d80c9c04519cc1e3cfa33dc20cb00f3585899
SSDEEP 196608:F97yH3LyEnfk2hxfX6HYlCtInou3eIIrmczlHFOhHWDHZobgC6t:fKM2ffXrTIrmczOQC6t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://raw.githubusercontent.com/SimpsyTV/SimpsyTV/main/STILauncher.bat

Extracted

Family

quasar

Version

1.4.1

Botnet

Desktop

minecraftdayzserver.ddns.net:2400

Mutex

75424b76-6e02-429f-933a-8f0c46b80ea3

Attributes

encryption_key
BAB780866E59DF462CB03FA8A8ABD639E9524897
install_name
WinRar.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WinRar.exe
subdirectory
temp

Targets

- Target
  STIMenu/Main/Extra/RunMenu.bat
- Size 2KB
- SHA256 4354441c02f160e9442b272c2a7f8c113201754d8287dc7e2419a5fc22fe954b
- MD5 7f9c24b3b5e0bcbd87981985b8c08823
- SHA1 c8196caab3579c495126799801f61992dfa619a6
- SHA512 f2b04367bffd9d6ff08d87b56c78292177e191593b82cd7992421476f05b1c224cdb21846fce74d8a708f2488ca97e92f545f1f970b70a7013d7d23c7216598c
- MD5 SHA1 SHA512
Score

10^/10

execution quasar desktop defense_evasion spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2
- Target
  STIMenu/Main/Extra/Updater.ps1
- Size 200B
- SHA256 22ad8ec31c9f5de8f1e06c9807dcc58350aee8103716c5c6c94171077a49c04a
- MD5 a4ab877ba686e46a8042a2a6eb260afa
- SHA1 8f10545aa83bc0681d241804de371628d680da0a
- SHA512 45e4129a4ff65e46b539c199cb26532a69104daa2f523c2ebd0bef1532913c15950da8e871bfb6a3a4ba73b6b4012cd074af83b6a13565cbae8883be92516b47
- MD5 SHA1 SHA512
Score

8^/10

execution
- Blocklisted process makes network request
- Legitimate hosting services abused for malware hosting/C2
behavioral3 behavioral4
- Target
  STIMenu/Main/HiveEXT.dll
- Size 1.3MB
- SHA256 145164ae39dfaefc634791ad8d6a810fa4dd15a654945ab1018dfd8f3874f558
- MD5 95a8b7bfc13e56e993aefd7b74258634
- SHA1 7400f0280092db5c188d93d8c3d10c05eadc0e3d
- SHA512 42e64083763853d0d19e3068ac5a48fe9a0b3b4c71c577f31749fb00bdbdefd23c6d61bb1172f9ed446d1971708b764e083eb9bf08a665561a3326fdbc065036
- SSDEEP 12288:dhHVDll8w5oM+E2VdAOYxqaOj1SzqtEWDxX892M36Oo6CsJoe0gv5CTG3dccKK3V:vVh+1vAHxvoSetbc3yWCTbcK+enRQ5
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  STIMenu/Main/tbb.dll
- Size 165KB
- SHA256 a1f95e193a35fbf2a727eea80ea926f7aa7928846580e93a5595845ff9792cb7
- MD5 d00816b72f29999ae295224d7696687b
- SHA1 297a813fdf6bed606293de8881b8d7dd4c43193c
- SHA512 37216a5339d4aae7ff7354ccdb3edf64795fe5f640585da561094e5624df0f910685fe131d32298b46f7bf724c40cc2b6f73b3b62affb0c807715d5528a2700f
- SSDEEP 3072:5fsJySgLDIWKHgiFAa4Oxn2/uVu7Ysf+Ya8BZY78YYstar35IiRGwcQqRtOk0LAT:uHg34tn2Gwg8B8SIuqRtOxs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  STIMenu/Main/tbbmalloc.dll
- Size 66KB
- SHA256 84ab89e62d5c30fbec9a99fd54a50dca0643dd00a6f613530c5e4409006278ac
- MD5 45e364ce59274f33140f9d5d2c3e5554
- SHA1 36dc6d0bb28a84b1a7cc2138a63b13ae7994a606
- SHA512 1bce50cf73c2d03ce1c020304d9bd00ec2d7e10981aa6732c3c0c5162c6c8b44a19ef6f2ccb7dd3e98ae126172648f0e2dc151ebfa7c3acaa6a86a72b995d148
- SSDEEP 1536:fjv7mZORzVqLJD4hpDXujZ8mPxwPPdbDDZUnQFlRQUP:rvKGV6WmsF/DZs+
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  STIMenu/STI Launcher.lnk
- Size 3KB
- SHA256 a94dd53a0cae120d9f519d65d0f4d3e3f488b73276ad2d193987cf68c588ad6c
- MD5 66eeece442e5eea4ae9c41e449732bce
- SHA1 ab53def6a5b44debcc9dbcf397c354f8470342a7
- SHA512 1275345ea5ea7e6659384879d6aa20487e97dd707d771b6f267594db9685c1d94f52bce4f95d6cc0471bdf88d06561667d806797ff95c356a1e2710ecf6124c0
- MD5 SHA1 SHA512
Score

10^/10

execution quasar desktop defense_evasion spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral11 behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Quasar RAT

Quasar payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Deobfuscate/Decode Files or Information

Legitimate hosting services abused for malware hosting/C2

Blocklisted process makes network request

Legitimate hosting services abused for malware hosting/C2

Quasar RAT

Quasar payload

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Deobfuscate/Decode Files or Information

Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12