quasar | 3ec670197c9d917b0f258ea9f093289ee2e4b829451b8c9aa8f1d2e7170a2d8b | Triage

Sharing

General

Target

3ec670197c9d917b0f258ea9f093289ee2e4b829451b8c9aa8f1d2e7170a2d8b.exe
Size

3.1MB
Sample

250120-cq6drswnhz
MD5

e69d5c216f6cf59c3b71b0bf3444803e
SHA1

e18de0fa930ed0ad786bd3e22c699762d93d3e95
SHA256

3ec670197c9d917b0f258ea9f093289ee2e4b829451b8c9aa8f1d2e7170a2d8b
SHA512

92ee6e7c5145b4281aaad5bdbe8f7a90c71ac247918112fbdb7f92256e9c562cdeeb15bb4716ee0dec168db96c1d7631023181ab7e932196effc653b8cb00527
SSDEEP

49152:nvkI22SsaNYfdPBldt698dBcjHfqDybRcboGdj/mTHHB72eh2NT:nvJ22SsaNYfdPBldt6+dBcjHfqDV

Score

10^/10

quasar 客户 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

客户

C2

121.36.102.48:1111

Mutex

043c1c13-ad0b-4e54-a900-6308db7e18c0

Attributes

encryption_key
CBC848F0E8EC6B1B06081D6FFA1D98A8EAB2442E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
Microsofl

Targets

- Target
  
  3ec670197c9d917b0f258ea9f093289ee2e4b829451b8c9aa8f1d2e7170a2d8b.exe
- Size
  
  3.1MB
- MD5
  
  e69d5c216f6cf59c3b71b0bf3444803e
- SHA1
  
  e18de0fa930ed0ad786bd3e22c699762d93d3e95
- SHA256
  
  3ec670197c9d917b0f258ea9f093289ee2e4b829451b8c9aa8f1d2e7170a2d8b
- SHA512
  
  92ee6e7c5145b4281aaad5bdbe8f7a90c71ac247918112fbdb7f92256e9c562cdeeb15bb4716ee0dec168db96c1d7631023181ab7e932196effc653b8cb00527
- SSDEEP
  
  49152:nvkI22SsaNYfdPBldt698dBcjHfqDybRcboGdj/mTHHB72eh2NT:nvJ22SsaNYfdPBldt6+dBcjHfqDV
Score

10^/10

quasar 客户 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasar客户spywaretrojan

behavioral2

quasar客户spywaretrojan