quasar | cfb7003085b0091a90edb102a6ddfea8c3bae48460994e733fa5134bdec9dfa9 | Triage

Sharing

General

Target

AHHAFS.exe
Size

3.1MB
Sample

241117-af4fbawlfy
MD5

63549bde2568a8d9fe3636559ff908fa
SHA1

e86ba5584ee39d224ac7662041d99e85ac8b4f43
SHA256

cfb7003085b0091a90edb102a6ddfea8c3bae48460994e733fa5134bdec9dfa9
SHA512

c64902094fe7b036c3681cc2eced4cb4872d1a6a0e02c4cb1ac2f74ee8d2c9d4570dafeeba39e0ffdf13d5365c60d0c8dc21eb9d42d0d673e16eafdbc5296f04
SSDEEP

49152:/vyI22SsaNYfdPBldt698dBcjHU2RJ6/bR3LoGdFTHHB72eh2NT:/vf22SsaNYfdPBldt6+dBcjHU2RJ6R

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

serveo.net:4782

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes

encryption_key
AEA258EF65BF1786F0F767C0BE2497ECC304C46F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  AHHAFS.exe
- Size
  
  3.1MB
- MD5
  
  63549bde2568a8d9fe3636559ff908fa
- SHA1
  
  e86ba5584ee39d224ac7662041d99e85ac8b4f43
- SHA256
  
  cfb7003085b0091a90edb102a6ddfea8c3bae48460994e733fa5134bdec9dfa9
- SHA512
  
  c64902094fe7b036c3681cc2eced4cb4872d1a6a0e02c4cb1ac2f74ee8d2c9d4570dafeeba39e0ffdf13d5365c60d0c8dc21eb9d42d0d673e16eafdbc5296f04
- SSDEEP
  
  49152:/vyI22SsaNYfdPBldt698dBcjHU2RJ6/bR3LoGdFTHHB72eh2NT:/vf22SsaNYfdPBldt6+dBcjHU2RJ6R
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasaroffice04spywaretrojan