quasar | 3f611d6373fe2105903cf00fd496055c94969fc3d4ead359d70ddc03baf247a8

General

Target
ratonhost.exe
Size 1.9MB
Sample260712-s52l5act8k
SHA256 3f611d6373fe2105903cf00fd496055c94969fc3d4ead359d70ddc03baf247a8
MD5 0b8c7ffd0bbe1bc324961dbe8b145490
SHA1 016a5e4eee34f9749f99e5dac2c30eb7f5c72b0e
SHA512 41192c7a996d63e718e6fd833d5a6bfa7fa0187d3c6691f18f0cdcf97c8ce44ded620434a5136dd0086defe6abac701691527337d8b3520d16f07dccb970ebe8
SSDEEP 24576:cEpdUtS2eWBRwRR16z/0m8yXP8oc5R2NntxY0KKm77yviUSQaZaOwI55l2S62r9o:cydi7wRPirm2NnPTKKm77LrwCB6uan
TLSH
T15095F110B7F58206F1BF1BB9A8B748450B77BA439A3AD35E488C605D1FB37509E913A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.7.3

Botnet

critical

C2

tcp.niceports.shop:22265

Mutex

e533e018-ce7e-422a-b379-4c90e7f46f91

Attributes

encryption_key
12518C4545D6D6D57F43040CDD2DC966CD5EA6C4
install_name
Solara.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
Logs
reconnect_delay
3000
startup_key
Pulsar Client Startup
subdirectory
SubDir

Targets

- Target
  ratonhost.exe
- Size 1.9MB
- SHA256 3f611d6373fe2105903cf00fd496055c94969fc3d4ead359d70ddc03baf247a8
- MD5 0b8c7ffd0bbe1bc324961dbe8b145490
- SHA1 016a5e4eee34f9749f99e5dac2c30eb7f5c72b0e
- SHA512 41192c7a996d63e718e6fd833d5a6bfa7fa0187d3c6691f18f0cdcf97c8ce44ded620434a5136dd0086defe6abac701691527337d8b3520d16f07dccb970ebe8
- SSDEEP 24576:cEpdUtS2eWBRwRR16z/0m8yXP8oc5R2NntxY0KKm77yviUSQaZaOwI55l2S62r9o:cydi7wRPirm2NnPTKKm77LrwCB6uan
- TLSH
  T15095F110B7F58206F1BF1BB9A8B748450B77BA439A3AD35E488C605D1FB37509E913A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware critical discovery quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2