quasar | dbb90c50173abf67a8e31ca95ed24f520e7109eb10fee038c786e1ecf1ec4f88

General

Target
2026-07-28_a1af5e54feaab7bc769f02c727edb221_glassworm_krakenkeylogger_njrat_poet-rat_quasar-rat_xrat
Size 112.3MB
Sample260728-vjz8aassfv
SHA256 dbb90c50173abf67a8e31ca95ed24f520e7109eb10fee038c786e1ecf1ec4f88
MD5 a1af5e54feaab7bc769f02c727edb221
SHA1 615a8e7b972a8d94af631c53582fa1ee96242506
SHA512 f0c418b50de0f8fb2036d9e6a5a96eed2bbc45c15c4acf493c2ff7bf6b7f2bc19101d6af8e20683f3484baedb31299b04a7ac669f4cc87983e771787f24b4377
SSDEEP 786432:E86u1ss1Dqys503YrFHmZlOH09TTbdLDMTFTb+9X6KPu4DLaoPmb:Ejis50HZRvaT1q9X6KPuSpOb
TLSH
T16A487C11A3E86E45D23B8278977386A1D675BC525311D2CF0094FD4A3F73BC2BA363A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
3CF1ED0C58825B01C5C50775DECCBB6B404E95F0
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  2026-07-28_a1af5e54feaab7bc769f02c727edb221_glassworm_krakenkeylogger_njrat_poet-rat_quasar-rat_xrat
- Size 112.3MB
- SHA256 dbb90c50173abf67a8e31ca95ed24f520e7109eb10fee038c786e1ecf1ec4f88
- MD5 a1af5e54feaab7bc769f02c727edb221
- SHA1 615a8e7b972a8d94af631c53582fa1ee96242506
- SHA512 f0c418b50de0f8fb2036d9e6a5a96eed2bbc45c15c4acf493c2ff7bf6b7f2bc19101d6af8e20683f3484baedb31299b04a7ac669f4cc87983e771787f24b4377
- SSDEEP 786432:E86u1ss1Dqys503YrFHmZlOH09TTbdLDMTFTb+9X6KPu4DLaoPmb:Ejis50HZRvaT1q9X6KPuSpOb
- TLSH
  T16A487C11A3E86E45D23B8278977386A1D675BC525311D2CF0094FD4A3F73BC2BA363A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects executables manipulated with Fody
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables manipulated with Fody

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2