quasar | 19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010 | Triage

Sharing

General

Target

19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe
Size

3.1MB
Sample

250213-cylz4askev
MD5

c4f9f10a96ad4665cd156ce3d1a9e29c
SHA1

10f32538070d3f615e1f2298f94f0250d846c8ed
SHA256

19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010
SHA512

fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482
SSDEEP

49152:vvyt62XlaSFNWPjljiFa2RoUYIlxPEakWk/LCcoGdIS/THHB72eh2NT:vva62XlaSFNWPjljiFXRoUYIlxS5Y

Score

10^/10

quasar minecrafter discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

minecrafter

C2

87.228.57.81:4782

Mutex

cf3988ab-2fd9-4544-a16f-9faa71eb5bac

Attributes

encryption_key
19A0FAF8459F69650B5965C225752D425C429EEC
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchoost.exe
subdirectory
SubDir

Targets

- Target
  
  19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010.exe
- Size
  
  3.1MB
- MD5
  
  c4f9f10a96ad4665cd156ce3d1a9e29c
- SHA1
  
  10f32538070d3f615e1f2298f94f0250d846c8ed
- SHA256
  
  19a41e1c599835a384e9bf414c7a65e1c60ae261e97e639cd3c0fd9f22afd010
- SHA512
  
  fc7277bb2c633c985c8d48c2d3b6936ec62b1c18daa6dd9043c817586eb531aa7116f28c998997b0a14db387dabe22e812957b33ddbed41732ce33afd8c07482
- SSDEEP
  
  49152:vvyt62XlaSFNWPjljiFa2RoUYIlxPEakWk/LCcoGdIS/THHB72eh2NT:vva62XlaSFNWPjljiFXRoUYIlxS5Y
Score

10^/10

quasar minecrafter spyware trojan discovery
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

minecrafterquasar

behavioral1

quasarminecrafterspywaretrojan

behavioral2

quasarminecrafterdiscoveryspywaretrojan