quasar | 03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

03854da09c...3N.exe

windows7-x64

03854da09c...3N.exe

windows10-2004-x64

Sharing

General

Target

03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03N.exe
Size

916KB
Sample

250124-j7h35ayngt
MD5

379bfcd9546c02dfbd06afbc9140c000
SHA1

a5787f9734d0dd42cd220ae3c1fa85868affb999
SHA256

03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03
SHA512

5fb98423f6f2684a8e04e6e0894214e27529c80c6dbb6e346922abbc1213b62e698f7e251d658e7d2fb18ba7a2023c28e86359c15de37e9eb13e9f634ab3e2cb
SSDEEP

24576:u3zSBJk4l/5b1nhD6g+0yQEuTLusJLK1lkloLX:azSBJk4l/5b1nhD6g+0yQEuRk1lk

Score

10^/10

quasar comquedinhaacoisaanda discovery spyware trojan

Static task

static1

comquedinhaacoisaanda quasar

3 signatures

Behavioral task

behavioral1

Sample

03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03N.exe

Resource

win7-20240903-en

quasar comquedinhaacoisaanda discovery spyware trojan

windows7-x64

6 signatures

120 seconds

Behavioral task

behavioral2

Sample

03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03N.exe

Resource

win10v2004-20241007-en

quasar comquedinhaacoisaanda discovery spyware trojan

windows10-2004-x64

6 signatures

120 seconds

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Comquedinhaacoisaanda

C2

190.102.40.205:5552

Mutex

PfN9Ye1THuAjieZbW1

Attributes

encryption_key
m4bU7sJJzbSU2TB27KbW
install_name
Venom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup

Targets

- Target
  
  03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03N.exe
- Size
  
  916KB
- MD5
  
  379bfcd9546c02dfbd06afbc9140c000
- SHA1
  
  a5787f9734d0dd42cd220ae3c1fa85868affb999
- SHA256
  
  03854da09c467b1ced2223a10fd1c9f281f3527a84651cec9930e5f42ba2cc03
- SHA512
  
  5fb98423f6f2684a8e04e6e0894214e27529c80c6dbb6e346922abbc1213b62e698f7e251d658e7d2fb18ba7a2023c28e86359c15de37e9eb13e9f634ab3e2cb
- SSDEEP
  
  24576:u3zSBJk4l/5b1nhD6g+0yQEuTLusJLK1lkloLX:azSBJk4l/5b1nhD6g+0yQEuRk1lk
Score

10^/10

quasar comquedinhaacoisaanda discovery spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

comquedinhaacoisaandaquasar

behavioral1

quasarcomquedinhaacoisaandadiscoveryspywaretrojan

behavioral2

quasarcomquedinhaacoisaandadiscoveryspywaretrojan

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.