quasar | 1b1b94ab940b67362b81053bc1f533246f988db580f78d993e4e0080ce798a77 | Triage

Sharing

General

Target

fuegoo.exe
Size

3.1MB
Sample

241109-gk7rvsygqm
MD5

6c42adb53394b149f5b7361e26b6e1f2
SHA1

3fbeff6276d1145af91ea0db55612f93c9ea41b3
SHA256

1b1b94ab940b67362b81053bc1f533246f988db580f78d993e4e0080ce798a77
SHA512

65020f225af38e546a824ebf3cfd89647280ad1698dd41b4ff2f0356857dea13454c39ce5f2caea7f8918688cdd1fc0f558d17869fc02f1c593d08148c26c111
SSDEEP

49152:WvyI22SsaNYfdPBldt698dBcjHXMRJ6nbR3LoGdxTHHB72eh2NT:Wvf22SsaNYfdPBldt6+dBcjHXMRJ65

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

190.104.116.8:139

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes

encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  fuegoo.exe
- Size
  
  3.1MB
- MD5
  
  6c42adb53394b149f5b7361e26b6e1f2
- SHA1
  
  3fbeff6276d1145af91ea0db55612f93c9ea41b3
- SHA256
  
  1b1b94ab940b67362b81053bc1f533246f988db580f78d993e4e0080ce798a77
- SHA512
  
  65020f225af38e546a824ebf3cfd89647280ad1698dd41b4ff2f0356857dea13454c39ce5f2caea7f8918688cdd1fc0f558d17869fc02f1c593d08148c26c111
- SSDEEP
  
  49152:WvyI22SsaNYfdPBldt698dBcjHXMRJ6nbR3LoGdxTHHB72eh2NT:Wvf22SsaNYfdPBldt6+dBcjHXMRJ65
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasaroffice04spywaretrojan