quasar | c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471 | Triage

Submit
Reports

Overview

overview

Static

static

c6bd4b5edf...71.exe

windows7-x64

c6bd4b5edf...71.exe

windows10-2004-x64

Sharing

General

Target

c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471
Size

3.1MB
Sample

241114-cy1hgstckl
MD5

d3598b9a1d21e32ecccbe82e7889717a
SHA1

a519a69ce3fa6fa7ccb1d7c7461aa910aed1fb38
SHA256

c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471
SHA512

d2992a4145fafac9ec1ab9d1cc5006549a8cfdbeb3b6f3b9ee0bd795a26db4143da5cbf770cc1ab9aea4fddd70d6e23b47db418f89c43f6884cc7bc7941896d9
SSDEEP

49152:rvnI22SsaNYfdPBldt698dBcjHvGRJ6SbR3LoGdLFWTHHB72eh2NT:rvI22SsaNYfdPBldt6+dBcjHvGRJ6MZ

Score

10^/10

quasar conference spyware trojan

Static task

static1

conference quasar

3 signatures

Behavioral task

behavioral1

Sample

c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471.exe

Resource

win7-20241010-en

quasar conference spyware trojan

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471.exe

Resource

win10v2004-20241007-en

quasar conference spyware trojan

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

conference

C2

192.168.0.52:22222

Mutex

2c77d2dc-d2f3-450b-97e7-f8c9be1057af

Attributes

encryption_key
970334103899B31880D90BCC0F3356263084F2F1
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471
- Size
  
  3.1MB
- MD5
  
  d3598b9a1d21e32ecccbe82e7889717a
- SHA1
  
  a519a69ce3fa6fa7ccb1d7c7461aa910aed1fb38
- SHA256
  
  c6bd4b5edf4b260eda98bb9cfdfae234c17ee097b9cf4ad0ee3fef377e791471
- SHA512
  
  d2992a4145fafac9ec1ab9d1cc5006549a8cfdbeb3b6f3b9ee0bd795a26db4143da5cbf770cc1ab9aea4fddd70d6e23b47db418f89c43f6884cc7bc7941896d9
- SSDEEP
  
  49152:rvnI22SsaNYfdPBldt698dBcjHvGRJ6SbR3LoGdLFWTHHB72eh2NT:rvI22SsaNYfdPBldt6+dBcjHvGRJ6MZ
Score

10^/10

quasar conference spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

conferencequasar

behavioral1

quasarconferencespywaretrojan

behavioral2

quasarconferencespywaretrojan

© 2018-2025

Terms | Privacy