quasar | 69e3aa56da9604b0f9bf30b11214fb5a5df83b535cb465b6510b8da201ade8f4

General

Target
2026-07-26_8d177b08628136d6d1c432d29a83d389_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
Size 12.4MB
Sample260726-3tzcqssgre
SHA256 69e3aa56da9604b0f9bf30b11214fb5a5df83b535cb465b6510b8da201ade8f4
MD5 8d177b08628136d6d1c432d29a83d389
SHA1 423a4181e44a9b945f4296fb6af23fc8afb99c9f
SHA512 bcb7dec7bde132a9dda74f517376f903dbae559d2e8adf3a095f31094d2c1472eb33944022c1aeeae84146c3834abe5c1d974aa4d15342475ec95cfd5642e5df
SSDEEP 393216:bQdfGY/tR85vz7WNINktL2Vmd6mOc/eBtE1rg:buo5vzlQyVmdUuR1E
TLSH
T1A9D6330126A446D6F9EA0539DC53D13EEF67F8221B16D9CF4360AB143E272E1AD3B760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

loli

C2

dev-c7dlrpjp473ipdjt-31160.portmap.host:31160

Mutex

b37c4cbf-68f4-4e7c-92ba-ac265729eb51

Attributes

encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  2026-07-26_8d177b08628136d6d1c432d29a83d389_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom
- Size 12.4MB
- SHA256 69e3aa56da9604b0f9bf30b11214fb5a5df83b535cb465b6510b8da201ade8f4
- MD5 8d177b08628136d6d1c432d29a83d389
- SHA1 423a4181e44a9b945f4296fb6af23fc8afb99c9f
- SHA512 bcb7dec7bde132a9dda74f517376f903dbae559d2e8adf3a095f31094d2c1472eb33944022c1aeeae84146c3834abe5c1d974aa4d15342475ec95cfd5642e5df
- SSDEEP 393216:bQdfGY/tR85vz7WNINktL2Vmd6mOc/eBtE1rg:buo5vzlQyVmdUuR1E
- TLSH
  T1A9D6330126A446D6F9EA0539DC53D13EEF67F8221B16D9CF4360AB143E272E1AD3B760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

loli execution quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables manipulated with Fody
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables manipulated with Fody

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2