quasar | f3334310ed9e1932230d4747f3a2d7012e820c79648183f512f9386a191d2765

General

Target
GoodOBF.bat
Size 2.3MB
Sample260929-v474mabh95
SHA256 f3334310ed9e1932230d4747f3a2d7012e820c79648183f512f9386a191d2765
MD5 5ec9565ec0dc72f66618a0184a302fa3
SHA1 37c0e9f28f818c4cd7b15169376abb892cac9776
SHA512 88aa1ce9e2d09553bf5496a6f3cf6bc1ecbddba43a07bf25feb1b231c33638a9e67e09bd3e11a0a08d136ba3e6f6069942db29ce7756c0783b44969326a99108
SSDEEP 24576:4e+9hhv3zxHkQlEnYuBQCftjLnWcUT+QbS2kt0W3LX1GUsCI2lLTZgCQKxN34+8T:4e+7EGMWdS+u3Ly2lEKxNc8M
TLSH
T17DB523B8D7A806EE0A11A4F73541F4147A5E66C35D834A17836CC29672BC8B51FEBC3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
C75C37F5794602D0FA11F69C27801E5DC319DB8F
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  GoodOBF.bat
- Size 2.3MB
- SHA256 f3334310ed9e1932230d4747f3a2d7012e820c79648183f512f9386a191d2765
- MD5 5ec9565ec0dc72f66618a0184a302fa3
- SHA1 37c0e9f28f818c4cd7b15169376abb892cac9776
- SHA512 88aa1ce9e2d09553bf5496a6f3cf6bc1ecbddba43a07bf25feb1b231c33638a9e67e09bd3e11a0a08d136ba3e6f6069942db29ce7756c0783b44969326a99108
- SSDEEP 24576:4e+9hhv3zxHkQlEnYuBQCftjLnWcUT+QbS2kt0W3LX1GUsCI2lLTZgCQKxN34+8T:4e+7EGMWdS+u3Ly2lEKxNc8M
- TLSH
  T17DB523B8D7A806EE0A11A4F73541F4147A5E66C35D834A17836CC29672BC8B51FEBC3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution quasar module rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Executes dropped EXE
- Loads dropped DLL
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

1

T1140

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

PulsaRAT library module

Quasar payload

Executes dropped EXE

Loads dropped DLL

Deobfuscate/Decode Files or Information

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2