quasar | af12a0fe7ac38dc5fe35e9bc07e2c4e94b52fb895fde35991f77477519991562

General

Target

af12a0fe7ac38dc5fe35e9bc07e2c4e94b52fb895fde35991f77477519991562.exe
Size

85.2MB
Sample

241220-fdshxsznaw
MD5

157a22896cc610d6310a2fa0f4a13005
SHA1

5e62076cad33e22d62413264113627114cbc8887
SHA256

af12a0fe7ac38dc5fe35e9bc07e2c4e94b52fb895fde35991f77477519991562
SHA512

1eba39a21c01950a12e78582e99253a48b3984564c4826890a577b849abfde20f3012eeea4a0c972f94faa153ba6aef90af57b8d0762b0920cf6a940ccd86b75
SSDEEP

393216:34TPZVLWruiFVks+9j54GXvitZQLCO5SXDqQu58EISEhoIaE2FShABZDv25PPa25:3KRVQxhu0P8Lq1LEvxOOx5Sv

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SenshiPepe

C2

51.15.17.193:4782

Mutex

3cedc6f6-6ab5-4aba-8d7d-5cda1b7ffa72

Attributes

encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  af12a0fe7ac38dc5fe35e9bc07e2c4e94b52fb895fde35991f77477519991562.exe
- Size
  
  85.2MB
- MD5
  
  157a22896cc610d6310a2fa0f4a13005
- SHA1
  
  5e62076cad33e22d62413264113627114cbc8887
- SHA256
  
  af12a0fe7ac38dc5fe35e9bc07e2c4e94b52fb895fde35991f77477519991562
- SHA512
  
  1eba39a21c01950a12e78582e99253a48b3984564c4826890a577b849abfde20f3012eeea4a0c972f94faa153ba6aef90af57b8d0762b0920cf6a940ccd86b75
- SSDEEP
  
  393216:34TPZVLWruiFVks+9j54GXvitZQLCO5SXDqQu58EISEhoIaE2FShABZDv25PPa25:3KRVQxhu0P8Lq1LEvxOOx5Sv
Score

10^/10

quasar senshipepe defense_evasion execution spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- System Binary Proxy Execution: Regsvcs/Regasm
  Abuse Regasm to proxy execution of malicious code.
  defense_evasion
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

1

T1218

Regsvcs/Regasm

1

T1218.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

System Binary Proxy Execution: Regsvcs/Regasm

Drops startup file

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2