quasar | 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6

General

Target
jfqca_Pulsar-Client.bat
Size 867KB
Sample251019-t16wqabl8v
SHA256 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6
MD5 f0e77390c4f252b0f558535bb81e21e9
SHA1 702452628ecaae717dfe273319dc8de15217f50f
SHA512 c6a4856f96ee79a25a84636ed9462f7c843351904c2a61887f3daef03000b3e498da798c3b09f40a396565336c6b1b534b4912e49efb8cb445d0d78c8f69dd79
SSDEEP 24576:XjnbkNZ+aIwWmW0cN8AEy/yL/EccSILwXoJ:X3wZRxW78zynJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
8FC8AEB39474756E1CA6DDD3F39D248A13B96C29
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  jfqca_Pulsar-Client.bat
- Size 867KB
- SHA256 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6
- MD5 f0e77390c4f252b0f558535bb81e21e9
- SHA1 702452628ecaae717dfe273319dc8de15217f50f
- SHA512 c6a4856f96ee79a25a84636ed9462f7c843351904c2a61887f3daef03000b3e498da798c3b09f40a396565336c6b1b534b4912e49efb8cb445d0d78c8f69dd79
- SSDEEP 24576:XjnbkNZ+aIwWmW0cN8AEy/yL/EccSILwXoJ:X3wZRxW78zynJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution quasar spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2