quasar | debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360 | Triage

Submit
Reports

Overview

overview

Static

static

debb1fc4bb...60.exe

windows7-x64

debb1fc4bb...60.exe

windows10-2004-x64

Sharing

General

Target

debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360
Size

3.1MB
Sample

241216-rwy9zatmbm
MD5

7d13d756b342ff87ce8db9749afac263
SHA1

97ca7f6dfbda61b1f81eedd15ac782caedd74db5
SHA256

debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360
SHA512

4683fffbde6993ed877f73b87b39ee40e712d822f18341bd20787183771af73cd07f9757a08a334b58be6ef61186db5f7285402ea5e90886654ecfa3085b8438
SSDEEP

49152:LvmI22SsaNYfdPBldt698dBcjHVWxNESEyk/iMLoGdBkTHHB72eh2NT:Lvr22SsaNYfdPBldt6+dBcjHAxpS

Score

10^/10

quasar office04 spyware trojan

Static task

static1

office04 quasar

3 signatures

Behavioral task

behavioral1

Sample

debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360.exe

Resource

win7-20240903-en

quasar office04 spyware trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360.exe

Resource

win10v2004-20241007-en

quasar office04 spyware trojan

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.100.2:4444

Mutex

72f080a6-63a5-4cb8-b261-46434c791afc

Attributes

encryption_key
6B74F0C858B7E90573D4E97997F2A082B9781250
install_name
Panel.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360
- Size
  
  3.1MB
- MD5
  
  7d13d756b342ff87ce8db9749afac263
- SHA1
  
  97ca7f6dfbda61b1f81eedd15ac782caedd74db5
- SHA256
  
  debb1fc4bbe5a6ee929d11766367ccc6f641610469fbd8e704895683db6f7360
- SHA512
  
  4683fffbde6993ed877f73b87b39ee40e712d822f18341bd20787183771af73cd07f9757a08a334b58be6ef61186db5f7285402ea5e90886654ecfa3085b8438
- SSDEEP
  
  49152:LvmI22SsaNYfdPBldt698dBcjHVWxNESEyk/iMLoGdBkTHHB72eh2NT:Lvr22SsaNYfdPBldt6+dBcjHAxpS
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasaroffice04spywaretrojan

behavioral2

quasaroffice04spywaretrojan

© 2018-2024

Terms | Privacy