quasar | 82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954 | Triage

Sharing

General

Target

82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954.exe
Size

2.1MB
Sample

241102-g5fh4sykcw
MD5

dc17a1ec3a9bb84d21a7f6a7e77133f6
SHA1

2a6c10ea20bff9e297770bca2477a8bb82378c45
SHA256

82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954
SHA512

eb321ab29735ecf574939cd01ee51f04a623382d83d22d8efc6538a1618af0bfa3a8407b0f6e3c54f55e4a780e2f5176004d50f9598a0a9935207635810cc042
SSDEEP

49152:YX5YSZrAEzwpX/qR0KlOmOdXcyhgkkTScqMkRnGfRlz+:K5YC4o0MOdX4zSPnGZh+

Score

10^/10

quasar panel.o7lab.me discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

panel.o7lab.me

C2

panel.o7lab.me:4782

service.o7lab.xyz:4782

underground-cheat.xyz:4782

service.o7lab.com.tr:4782

Mutex

84f88b7e-fbb8-40b1-829a-206ff17d9f29

Attributes

encryption_key
9D5D5E73AB412A75009506F89BC73714AF89F744
install_name
Client.exe
log_directory
WinLog
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954.exe
- Size
  
  2.1MB
- MD5
  
  dc17a1ec3a9bb84d21a7f6a7e77133f6
- SHA1
  
  2a6c10ea20bff9e297770bca2477a8bb82378c45
- SHA256
  
  82687bbf89460d44b3cef2d06f5d09288c45d787323254026f39cb3421cc3954
- SHA512
  
  eb321ab29735ecf574939cd01ee51f04a623382d83d22d8efc6538a1618af0bfa3a8407b0f6e3c54f55e4a780e2f5176004d50f9598a0a9935207635810cc042
- SSDEEP
  
  49152:YX5YSZrAEzwpX/qR0KlOmOdXcyhgkkTScqMkRnGfRlz+:K5YC4o0MOdX4zSPnGZh+
Score

10^/10

discovery quasar panel.o7lab.me spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

quasarpanel.o7lab.mediscoveryspywaretrojan