quasar | 883f05eacc88e639ff82bc43daec3d116d0d032b3ce7c90888e191e795bbcf44

General

Target
2026-09-28_b84424a03ef688bd83acba684ce355b0_cobalt-strike_icedid_satacom_stealc
Size 1.0MB
Sample260928-prcjastfrf
SHA256 883f05eacc88e639ff82bc43daec3d116d0d032b3ce7c90888e191e795bbcf44
MD5 b84424a03ef688bd83acba684ce355b0
SHA1 810b474424b8c9551707b8716a2ba61499a96838
SHA512 621a7a510864a1652f32ebba13f79bd0ee823f3b3dc886b10a5bbee75a7ac4181b33599a2512f6678fb51c292870ef0aebab0c8a75e12edc1c083a3d779e4fd7
SSDEEP 24576:nzUa51Kq8KhT4IhUO8JfOBE+pkyRb4TM25caMdaGsv7:nga5aE4IhUO8Jf3+php4TR5cJdZsv7
TLSH
T15A3512E2B3D800F9E227913889D24146AB7978156760AFEF03A1477ACF336E18D3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
201DD00471CE7A47F3BA9A76C0248E371A146DBC
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
500

Targets

- Target
  2026-09-28_b84424a03ef688bd83acba684ce355b0_cobalt-strike_icedid_satacom_stealc
- Size 1.0MB
- SHA256 883f05eacc88e639ff82bc43daec3d116d0d032b3ce7c90888e191e795bbcf44
- MD5 b84424a03ef688bd83acba684ce355b0
- SHA1 810b474424b8c9551707b8716a2ba61499a96838
- SHA512 621a7a510864a1652f32ebba13f79bd0ee823f3b3dc886b10a5bbee75a7ac4181b33599a2512f6678fb51c292870ef0aebab0c8a75e12edc1c083a3d779e4fd7
- SSDEEP 24576:nzUa51Kq8KhT4IhUO8JfOBE+pkyRb4TM25caMdaGsv7:nga5aE4IhUO8Jf3+php4TR5cJdZsv7
- TLSH
  T15A3512E2B3D800F9E227913889D24146AB7978156760AFEF03A1477ACF336E18D3E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion quasar module rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables manipulated with Fody
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

1

T1622

Credential Access

Discovery

Debugger Evasion

1

T1622

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

PulsaRAT library module

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Detects executables manipulated with Fody

Executes dropped EXE

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2