quasar | 7861d660a6f9f6e7457754929fa31d7efe7cdd50313394e717303ac1fa5d4687

General

Target
Mod Menu + Bypass.bat
Size 88KB
Sample261009-tyrc9azzev
SHA256 7861d660a6f9f6e7457754929fa31d7efe7cdd50313394e717303ac1fa5d4687
MD5 f9203c80cf930684c81ffa166a075696
SHA1 6fec792791b0ff157ff184e85597675b5030ed11
SHA512 15271e657c02c9f39f7ac240b7711c7b8107e66f83202f1af33a5719c5d242322897c5b38b39af619c4d63f1d416e136e5c0886dd7d3b6ac38e414898e35a6af
SSDEEP 1536:MHeOCNCIO3e9RGIvK6o+sU9B2uzuhYHFKLiUPN1vMuJG9:M+OCNCL3OoDMheiUPN1vMug9
TLSH
T173935B325D07AE4A6BB82B654ECF39D82E4FD3CB236484DE741650FD727C09299DC2A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
71D7DFC6C58F396C8369C0D3856FD86B9CCA7D85
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  Mod Menu + Bypass.bat
- Size 88KB
- SHA256 7861d660a6f9f6e7457754929fa31d7efe7cdd50313394e717303ac1fa5d4687
- MD5 f9203c80cf930684c81ffa166a075696
- SHA1 6fec792791b0ff157ff184e85597675b5030ed11
- SHA512 15271e657c02c9f39f7ac240b7711c7b8107e66f83202f1af33a5719c5d242322897c5b38b39af619c4d63f1d416e136e5c0886dd7d3b6ac38e414898e35a6af
- SSDEEP 1536:MHeOCNCIO3e9RGIvK6o+sU9B2uzuhYHFKLiUPN1vMuJG9:M+OCNCL3OoDMheiUPN1vMug9
- TLSH
  T173935B325D07AE4A6BB82B654ECF39D82E4FD3CB236484DE741650FD727C09299DC2A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution discovery quasar module persistence rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

PulsaRAT library module

Quasar payload

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2