quasar | 781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553 | Triage

Sharing

General

Target

781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe
Size

3.1MB
Sample

241217-dxw94sypc1
MD5

7b168e023b1876cd9163d58f98f3b67c
SHA1

906a5cfacd3797c603f3efe863aaedeabacb5918
SHA256

781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553
SHA512

bed18054e9fce2cdc185e4536386d042f20d98c9354e1603bb87b8747403e63bdbabfb88e72708dcdfb3468860655dcb34b237024d3395782c092dd772fec518
SSDEEP

49152:avkt62XlaSFNWPjljiFa2RoUYIlBRJ63bR3LoGdGFTHHB72eh2NT:av462XlaSFNWPjljiFXRoUYIlBRJ6J

Score

10^/10

quasar runtimebroker spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RunTimeBroker

C2

98.51.190.130:20

Mutex

11bbf22e-826e-486b-b024-adbd86228a9e

Attributes

encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ctfmon
subdirectory
SubDir

Targets

- Target
  
  781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553.exe
- Size
  
  3.1MB
- MD5
  
  7b168e023b1876cd9163d58f98f3b67c
- SHA1
  
  906a5cfacd3797c603f3efe863aaedeabacb5918
- SHA256
  
  781cdac62a589c52b2fb004eb53b262d4c2c29229cbbbd19a16d1669237ae553
- SHA512
  
  bed18054e9fce2cdc185e4536386d042f20d98c9354e1603bb87b8747403e63bdbabfb88e72708dcdfb3468860655dcb34b237024d3395782c092dd772fec518
- SSDEEP
  
  49152:avkt62XlaSFNWPjljiFa2RoUYIlBRJ63bR3LoGdGFTHHB72eh2NT:av462XlaSFNWPjljiFXRoUYIlBRJ6J
Score

10^/10

quasar runtimebroker spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

runtimebrokerquasar

behavioral1

quasarruntimebrokerspywaretrojan

behavioral2

quasarruntimebrokerspywaretrojan