quasar | e15a03db8ad4475fcc712d10500810aca8f925512b39c5bad6f1c1a20c6f785d | Triage

Sharing

General

Target

ImageLoggerBuilder.exe
Size

3.1MB
Sample

241017-tjbdgstcpc
MD5

32ee83c0da0f7c355e7600bfe40cfe89
SHA1

9616e83a0cf27f21a561f0d3ea292254b9b685d2
SHA256

e15a03db8ad4475fcc712d10500810aca8f925512b39c5bad6f1c1a20c6f785d
SHA512

e5ddad8f8640ed1b514fd6f9c1817e18290ba1bcc8654f150b31fe817065f99028f79cfeea6e4145a701b38fa21b7f8b3f14c11e4084f3650957e6e424975088
SSDEEP

49152:mvyI22SsaNYfdPBldt698dBcjHbemDmzKKoGd1THHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHbemU

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Aynamit-58285.portmap.io:58285

Mutex

7d6c4039-1882-4ac3-8711-9edc060091eb

Attributes

encryption_key
B414A2AEA68C8F212513170411C6C2ACB8A1A963
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  ImageLoggerBuilder.exe
- Size
  
  3.1MB
- MD5
  
  32ee83c0da0f7c355e7600bfe40cfe89
- SHA1
  
  9616e83a0cf27f21a561f0d3ea292254b9b685d2
- SHA256
  
  e15a03db8ad4475fcc712d10500810aca8f925512b39c5bad6f1c1a20c6f785d
- SHA512
  
  e5ddad8f8640ed1b514fd6f9c1817e18290ba1bcc8654f150b31fe817065f99028f79cfeea6e4145a701b38fa21b7f8b3f14c11e4084f3650957e6e424975088
- SSDEEP
  
  49152:mvyI22SsaNYfdPBldt698dBcjHbemDmzKKoGd1THHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHbemU
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasaroffice04spywaretrojan