quasar | 41bd24fe8b67e9e3cd5bb272a07640de345c39f6cb6c4057491838de95dac6d7 | Triage

Sharing

General

Target

Client-built.exe
Size

3.1MB
Sample

241217-g7rddssqgw
MD5

cf049d1ba0fceeb5348f71e15889fbc4
SHA1

94cc88586240456f777aed403d955027555db8d1
SHA256

41bd24fe8b67e9e3cd5bb272a07640de345c39f6cb6c4057491838de95dac6d7
SHA512

2e7a7d3415164cb453193fdceef02d46c35f9103521b33bc424c9b79659fac2e4b9deb0fe8754f0842546b51403181032b6c7a05116adfc4f2b8fd599c3ad6ed
SSDEEP

49152:avelL26AaNeWgPhlmVqvMQ7XSKIxOEMkek/JxwoGdeTHHB72eh2NT:avOL26AaNeWgPhlmVqkQ7XSKIxty

Score

10^/10

quasar rat 5 (epic verison)persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RAT 5 (EPIC VERISON)

C2

serveo.net:11453

Mutex

7a1301f7-dc6f-4847-a8ee-ca627a9efa0f

Attributes

encryption_key
3B793156AD6D884F51309D0E992DAA75D03D2783
install_name
Application Frame Host.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft
subdirectory
SubDir

Targets

- Target
  
  Client-built.exe
- Size
  
  3.1MB
- MD5
  
  cf049d1ba0fceeb5348f71e15889fbc4
- SHA1
  
  94cc88586240456f777aed403d955027555db8d1
- SHA256
  
  41bd24fe8b67e9e3cd5bb272a07640de345c39f6cb6c4057491838de95dac6d7
- SHA512
  
  2e7a7d3415164cb453193fdceef02d46c35f9103521b33bc424c9b79659fac2e4b9deb0fe8754f0842546b51403181032b6c7a05116adfc4f2b8fd599c3ad6ed
- SSDEEP
  
  49152:avelL26AaNeWgPhlmVqvMQ7XSKIxOEMkek/JxwoGdeTHHB72eh2NT:avOL26AaNeWgPhlmVqkQ7XSKIxty
Score

10^/10

quasar rat 5 (epic verison)persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rat 5 (epic verison)quasar

behavioral1

quasarrat 5 (epic verison)persistencespywaretrojan

behavioral2

quasarrat 5 (epic verison)persistencespywaretrojan