quasar | 4775be5e37b615fddfe7cb40f78b3fd395bc2d299132f9645da1fecea53e9acb

General

Target
ravexcoin-qt-win64.zip
Size 65.8MB
Sample260114-q2rxeaet9d
SHA256 4775be5e37b615fddfe7cb40f78b3fd395bc2d299132f9645da1fecea53e9acb
MD5 c53c130822639392810531249fad76bb
SHA1 14588032fac1f4c154d2250b26af64dfa0f4ab61
SHA512 3145d411173e4da91c3e3bae6ab8da379da16138c1f8ea1cf131ddafb3e53820ec42893b41db93868eacc6551f66d74f2e471dc3ba9b89f69a9b93aeee23af81
SSDEEP 1572864:hSY+UrHy3+E5AYm542g1wERWKbkLUXMSqaf+OG3J:hSf53Al54287LcSptKJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

BTC

C2

62.164.177.43:5850

Mutex

baba152c-827a-468c-895b-247b083695cc

Attributes

encryption_key
EA4E07B7C14A070A3F9E53FC586C35963A63E420
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Distr
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  ravexcoin-qt-win64.exe
- Size 3.1MB
- SHA256 fb4724ee7a212ac268def735313a7c47771a02ecf632595ef9c704238972c9d3
- MD5 afa45559bad107b8a58aea917ef34410
- SHA1 8f6e9909172ccf74c38145729ceb77937b933270
- SHA512 0c63dafb52716d4b9187e857672dbf8c93fe56d9abf090b0d0f67a65472f9767babbc8868272f5d05c6a357b4e3e0d2a7e71ee2d348cfe0a0f0b5c693f89696c
- SSDEEP 49152:cEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVlJjn33380:c92bz2Eb6pd7B6bAGx73tn333L
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

btc discovery quasar spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Quasar RAT

Quasar family

Quasar payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2