quasar | 0441f34c0995acb20d834b3ff4abb0c3a2719ab7a44577e5fac29e6b9bb851cd

General

Target
jaffacakes118_0441f34c0995acb20d834b3ff4abb0c3a2719ab7a44577e5fac29e6b9bb851cd.bin
Size 2.3MB
Sample260912-nf8a6avhpb
SHA256 0441f34c0995acb20d834b3ff4abb0c3a2719ab7a44577e5fac29e6b9bb851cd
MD5 89f195606b36a7ebbcdef261f84ce791
SHA1 548aa03ffd842f0e90862203b37b3fcab449a21f
SHA512 19519c45b12b0a632b3bb378c80799025cb4e6e6366f367ba779f825e49bf8790ef4c81c86fc044e4c3347fff21c87ef670f651d70e0fc0a375b4e5746beb146
SSDEEP 49152:sb5De3G1LrDpykQCf4mR94oMW7KNroBjRrdSHb9yaGCQW1CXNA0eUlvz:gHfD34mR94ouNrEFrdo9yaVQqqNA0eIb
TLSH
T1B6B533E8BA802FA799972EB76F2C60B1FD11829988B63E459CCC247B05757F37F14094
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.77:4782
192.168.1.79:4782

Mutex

e819f327-90a2-4d90-a826-8b38a9c4f3d5

Attributes

encryption_key
EFEBD005E03B8B8669985D9A167E2BEF9FFCA477
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  skibidi-main/Client-built.exe
- Size 3.1MB
- SHA256 0d0646d4f062fab91f6dbcbcc5412e6ef550306b1a49e2353bc37fd24aa4660e
- MD5 7e1ed4c0bddfcd9753fa8a34369d2a09
- SHA1 a72002b3e87c94524bb777fc50aadcd444597b28
- SHA512 cbcc8efa4d68e3e993dd0b8951d4e4fe0930d267ab99f0ad2f03a89e8f4d119210dccd4c5d4ad2b15d14125e852ef464564d6a88a41eaa936f6a6f2272123ff3
- SSDEEP 49152:CvyI22SsaNYfdPBldt698dBcjHHUb7ReaoGdk8THHB72eh2NT:Cvf22SsaNYfdPBldt6+dBcjHHUb7RJ
- TLSH
  T18DE54A1437F85E22E16BD2B3D5F0501763F1F82AF3A3EB0B6181A67E2C93B5158416A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

office04 quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1 behavioral2
- Target
  skibidi-main/CondoGenerator.exe
- Size 3.1MB
- SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
- MD5 5da0a355dcd44b29fdd27a5eba904d8d
- SHA1 1099e489937a644376653ab4b5921da9527f50a9
- SHA512 289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6
- SSDEEP 49152:3viI22SsaNYfdPBldt698dBcjHFfRJ6fbR3LoGd5THHB72eh2NT:3vv22SsaNYfdPBldt6+dBcjHFfRJ6x
- TLSH
  T1E9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

office04 discovery execution quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral3 behavioral4
- Target
  skibidi-main/test.exe
- Size 85KB
- SHA256 8258dbfeb33c23ebb17f11bf9f47e4516a3dd72ce46291eb0675604220d9f88b
- MD5 76e5b2935aad210eb83db2fd11b6d32a
- SHA1 485402fa81efa28ba8c24d32d16d76e69c470224
- SHA512 37d142efc70e7cdd48ece5b624daf8306de798ddd3f6d2f3d771a30bce49559afa1e8b7799538ffdbe1f4477c3e452d4a30d4273d6ad95227901ab3062ddeb2d
- SSDEEP 1536:0/neoXd+OYrhV4iOEt8T4vpNoSrJrFRR17WrUQ15/eaw3UDLQoGd3mPK3WOVRj0C:OneoXEOYrhV4iOEt8T4vpNoSrJrFRR1r
- TLSH
  T19583FAED24417AFAF1482EAE6213B060BCFA272F5549CCD97BDC95309364778CA2DC52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6