quasar | b8945d8da0c1d443af7636f42c9a037bbbf59d67e97ee17a826d243efa5f1246

General

Target
2026-06-27_a72ee60e65a8d8c1d8a95939b148b1e6_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat
Size 2.2MB
Sample260629-etxbdacy8t
SHA256 b8945d8da0c1d443af7636f42c9a037bbbf59d67e97ee17a826d243efa5f1246
MD5 a72ee60e65a8d8c1d8a95939b148b1e6
SHA1 57151c639c3a4712454cb0509daff0fd997e0721
SHA512 860d91e3f63690989442821da20c0386b8d36ac2fa4a66404302b0ab625ae5678864dc02d8aa7b45124754d8dfeb2769864fad578c0b7fbba44734e17204e900
SSDEEP 24576:UgOffndeUIBXxtCpD/HoQiOUZmJsSoWnjTRVglQLTv3wL2HClYasW0l73ItGI/2D:hOo13aIQokTVvy2raiGp+XaCIOhG+
TLSH
T136B5DF02FBC390F2D49B0174607BA77F4B3A69142320CEE7D7906E65ED226D2693939D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
C57BEB631C180265E150CEB43C174203E82D4BCA
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  2026-06-27_a72ee60e65a8d8c1d8a95939b148b1e6_akira_amadey_blankgrabber_elex_glassworm_luca-stealer_njrat
- Size 2.2MB
- SHA256 b8945d8da0c1d443af7636f42c9a037bbbf59d67e97ee17a826d243efa5f1246
- MD5 a72ee60e65a8d8c1d8a95939b148b1e6
- SHA1 57151c639c3a4712454cb0509daff0fd997e0721
- SHA512 860d91e3f63690989442821da20c0386b8d36ac2fa4a66404302b0ab625ae5678864dc02d8aa7b45124754d8dfeb2769864fad578c0b7fbba44734e17204e900
- SSDEEP 24576:UgOffndeUIBXxtCpD/HoQiOUZmJsSoWnjTRVglQLTv3wL2HClYasW0l73ItGI/2D:hOo13aIQokTVvy2raiGp+XaCIOhG+
- TLSH
  T136B5DF02FBC390F2D49B0174607BA77F4B3A69142320CEE7D7906E65ED226D2693939D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables manipulated with Fody
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables manipulated with Fody

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2