quasar | 435385b409d5a3b1868b6d25016b9deb9ae6dd488341a0ab7af6ba345be1b376 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...b9.exe

windows7-x64

JaffaCakes...b9.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_98600590c6930d77cb2436917e666cb9
Size

844KB
Sample

250105-kml5qa1mbn
MD5

98600590c6930d77cb2436917e666cb9
SHA1

e31ab0e597082ee1e415d0523a13b5d9175963c9
SHA256

435385b409d5a3b1868b6d25016b9deb9ae6dd488341a0ab7af6ba345be1b376
SHA512

55f3d5ebb77d2448bc961406967e2642dd720bba0d8278421cba27c8e3a18578f8ba85edb3a7072ed3032edd6f411225245ab9ff42cb85afd40b697d3e6af237
SSDEEP

12288:1l94NkE0XOHXzMidGXY4LzPkTOAO+u8ixFUibMcXVY+RWb/vu7ZxNRf9XB5b:XVE0SdGXY4n4O+KIIYm6ebNh9RN

Score

10^/10

quasar discovery execution spyware trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_98600590c6930d77cb2436917e666cb9.exe

Resource

win7-20240903-en

quasar discovery execution spyware trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_98600590c6930d77cb2436917e666cb9.exe

Resource

win10v2004-20241007-en

quasar discovery execution spyware trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_98600590c6930d77cb2436917e666cb9
- Size
  
  844KB
- MD5
  
  98600590c6930d77cb2436917e666cb9
- SHA1
  
  e31ab0e597082ee1e415d0523a13b5d9175963c9
- SHA256
  
  435385b409d5a3b1868b6d25016b9deb9ae6dd488341a0ab7af6ba345be1b376
- SHA512
  
  55f3d5ebb77d2448bc961406967e2642dd720bba0d8278421cba27c8e3a18578f8ba85edb3a7072ed3032edd6f411225245ab9ff42cb85afd40b697d3e6af237
- SSDEEP
  
  12288:1l94NkE0XOHXzMidGXY4LzPkTOAO+u8ixFUibMcXVY+RWb/vu7ZxNRf9XB5b:XVE0SdGXY4n4O+KIIYm6ebNh9RN
Score

10^/10

quasar discovery execution spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasardiscoveryexecutionspywaretrojan

behavioral2

quasardiscoveryexecutionspywaretrojan

© 2018-2025

Terms | Privacy