quasar | 498de1d7e7b9a0888b4f844fe82046ecfc5aa6d5a7a7da92782993eb76c2ea11

General

Target
2026-08-15_aba97431526a62f868301f356bd17770_blankgrabber_cobalt-strike_icedid_njrat_satacom
Size 10.8MB
Sample260816-aeafvaaj8w
SHA256 498de1d7e7b9a0888b4f844fe82046ecfc5aa6d5a7a7da92782993eb76c2ea11
MD5 aba97431526a62f868301f356bd17770
SHA1 fcdd5c343a5f06edd13d4275b4ec8d36ea055e71
SHA512 0ea790a3454335bed3cb14a313aabe22224ee11dc9c018c7abbc56a5ddf31aaadad37104b6a8261722dba325a2193a58e700b5f5dddb26f368d3c571346e35c0
SSDEEP 196608:ybebvL7ZyTihfwd32JMVUu0urIi6YTyfi0TbesIyest2wbEBON6MUhBNv483O:yeLkTVhsu0urIkTy3es97Ul0Ar4
TLSH
T15EB633A5F5A705F8E87F997CD4020182E077B91E0BE404E719684AF65E11BD2CB3BF62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.7.2

Botnet

Office04

C2

172.0.0.1:4782

Mutex

31b5a3e6-f113-4f87-8d18-84d562ec8218

Attributes

encryption_key
E188551831C990780007D88344EFA57F211FD9F7
install_name
Client.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
Logs
reconnect_delay
3000
startup_key
Pulsar Client Startup
subdirectory
SubDir

Targets

- Target
  2026-08-15_aba97431526a62f868301f356bd17770_blankgrabber_cobalt-strike_icedid_njrat_satacom
- Size 10.8MB
- SHA256 498de1d7e7b9a0888b4f844fe82046ecfc5aa6d5a7a7da92782993eb76c2ea11
- MD5 aba97431526a62f868301f356bd17770
- SHA1 fcdd5c343a5f06edd13d4275b4ec8d36ea055e71
- SHA512 0ea790a3454335bed3cb14a313aabe22224ee11dc9c018c7abbc56a5ddf31aaadad37104b6a8261722dba325a2193a58e700b5f5dddb26f368d3c571346e35c0
- SSDEEP 196608:ybebvL7ZyTihfwd32JMVUu0urIi6YTyfi0TbesIyest2wbEBON6MUhBNv483O:yeLkTVhsu0urIkTy3es97Ul0Ar4
- TLSH
  T15EB633A5F5A705F8E87F997CD4020182E077B91E0BE404E719684AF65E11BD2CB3BF62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

office04 quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables manipulated with Fody
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables manipulated with Fody

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2