quasar | 2b705bed48e179518b89fc0e1bb3d6ba20f6775a0a5f39c9237584c66c7fb7a5 | Triage

Sharing

General

Target

2b705bed48e179518b89fc0e1bb3d6ba20f6775a0a5f39c9237584c66c7fb7a5.exe
Size

3.1MB
Sample

250208-qlacesxkct
MD5

a8266637e953feb5248135a3a9374666
SHA1

3a0773ff3f442e1ba41def732548142d37d823af
SHA256

2b705bed48e179518b89fc0e1bb3d6ba20f6775a0a5f39c9237584c66c7fb7a5
SHA512

cf2e24018a043b295e00b18797e6175ea57246207555caca6255893e8dd7458eae88572bc60cd5af364d962199705f9d60bb6b68709309b40e25ed3697e8e01d
SSDEEP

49152:jvyt62XlaSFNWPjljiFa2RoUYIMcOhyvJo3oGdFTHHB72eh2NTP:jva62XlaSFNWPjljiFXRoUYIWhRc

Score

10^/10

quasar githubyt discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

githubyt

C2

87.228.57.81:4782

Mutex

cf3988ab-2fd9-4544-a16f-9faa71eb5bac

Attributes

encryption_key
19A0FAF8459F69650B5965C225752D425C429EEC
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchoost.exe
subdirectory
SubDir

Targets

- Target
  
  2b705bed48e179518b89fc0e1bb3d6ba20f6775a0a5f39c9237584c66c7fb7a5.exe
- Size
  
  3.1MB
- MD5
  
  a8266637e953feb5248135a3a9374666
- SHA1
  
  3a0773ff3f442e1ba41def732548142d37d823af
- SHA256
  
  2b705bed48e179518b89fc0e1bb3d6ba20f6775a0a5f39c9237584c66c7fb7a5
- SHA512
  
  cf2e24018a043b295e00b18797e6175ea57246207555caca6255893e8dd7458eae88572bc60cd5af364d962199705f9d60bb6b68709309b40e25ed3697e8e01d
- SSDEEP
  
  49152:jvyt62XlaSFNWPjljiFa2RoUYIMcOhyvJo3oGdFTHHB72eh2NTP:jva62XlaSFNWPjljiFXRoUYIWhRc
Score

10^/10

quasar githubyt spyware trojan discovery
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasargithubytspywaretrojan

behavioral2

quasargithubytdiscoveryspywaretrojan