quasar | da934e1affcbff3a93e24585394ffa3be9dff3c6ed77692dccbe44d62f11ec42

General

Target
xda934e1affcbff3a93e24585394ffa3be9dff3c6ed77692dccbe44d62f11ec42.exe
Size 13.4MB
Sample260702-x8ptysds8s
SHA256 da934e1affcbff3a93e24585394ffa3be9dff3c6ed77692dccbe44d62f11ec42
MD5 d0d09e0f2aa952b9fea82ca70592ebdd
SHA1 2ff9d41d1b505b9a4c62d11e0fc3eedec08e37b8
SHA512 64506a3883e35ffee213604ef25217ae4f22aa8e93e97db0e00219755ecb249228356ab51e177543ed1207c9128f7d17b08f355f1cc7ccc851fb5778f0c202e2
SSDEEP 393216:8ZxNrktZq5XcsHsGXqm7SPxc3W1ejKPQBAR:8FrktZq5ntX3z3BoQ
TLSH
T1FAE62358F3E405A6E0BF6238D9B24506DBB2B8265B31CBCF16D4516D2F733808D397A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
9D73DA4B8C2065508AC90851AE21E2733B27D448
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  xda934e1affcbff3a93e24585394ffa3be9dff3c6ed77692dccbe44d62f11ec42.exe
- Size 13.4MB
- SHA256 da934e1affcbff3a93e24585394ffa3be9dff3c6ed77692dccbe44d62f11ec42
- MD5 d0d09e0f2aa952b9fea82ca70592ebdd
- SHA1 2ff9d41d1b505b9a4c62d11e0fc3eedec08e37b8
- SHA512 64506a3883e35ffee213604ef25217ae4f22aa8e93e97db0e00219755ecb249228356ab51e177543ed1207c9128f7d17b08f355f1cc7ccc851fb5778f0c202e2
- SSDEEP 393216:8ZxNrktZq5XcsHsGXqm7SPxc3W1ejKPQBAR:8FrktZq5ntX3z3BoQ
- TLSH
  T1FAE62358F3E405A6E0BF6238D9B24506DBB2B8265B31CBCF16D4516D2F733808D397A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Executes dropped EXE

Loads dropped DLL

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2