quasar | edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17 | Triage

Sharing

General

Target

edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17.exe
Size

8.2MB
Sample

241220-kabhfsvlcp
MD5

ab0d88d920d75c9de43ccbdd901c8a53
SHA1

638197f5a23428f1c15a0a5473b6558d263b0a0c
SHA256

edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17
SHA512

25e1f1f5afe0cb1920be2d6a1db59f11b9f34b0bd154d3d553eb0dc44ecbc810463a7e1dcca5a176d7a08f0a34ed3e669a56cd35f9cc5ed796bfa5385f0e15f7
SSDEEP

98304:L6KJqPxBPsa29RMwzAAFySYrz0Cvt30F0BS9YR4:LHWPsa+RMwzVu0kJ0mBH4

Score

10^/10

quasar slimo spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slimo

C2

51.15.17.193:4782

Mutex

e318fab0-811e-40a6-b0aa-1e21015956c8

Attributes

encryption_key
97599F6E5D14A784CC4DD36B18A277119042FDA8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17.exe
- Size
  
  8.2MB
- MD5
  
  ab0d88d920d75c9de43ccbdd901c8a53
- SHA1
  
  638197f5a23428f1c15a0a5473b6558d263b0a0c
- SHA256
  
  edb3d030a4a033bae41057c19437dff31c171573b65afab0acd433cbd0572a17
- SHA512
  
  25e1f1f5afe0cb1920be2d6a1db59f11b9f34b0bd154d3d553eb0dc44ecbc810463a7e1dcca5a176d7a08f0a34ed3e669a56cd35f9cc5ed796bfa5385f0e15f7
- SSDEEP
  
  98304:L6KJqPxBPsa29RMwzAAFySYrz0Cvt30F0BS9YR4:LHWPsa+RMwzVu0kJ0mBH4
Score

10^/10

quasar slimo spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

quasarslimospywaretrojan

behavioral2

quasarslimospywaretrojan