quasar | 24902459acade2d7ea5b85bb110defa5b45e4459a30a36f5ef6cdaa53dc682b1

General

Target
2026-10-19_91b02f2215985ae08c15f2712b8bfe74_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_mass-logger_ngrbot_njrat_poet-rat_quasar-rat_vidar_xrat
Size 5.3MB
Sample261020-p5tpqsbf36
SHA256 24902459acade2d7ea5b85bb110defa5b45e4459a30a36f5ef6cdaa53dc682b1
MD5 91b02f2215985ae08c15f2712b8bfe74
SHA1 e4d9c721e5cc9436b5de03a4d79a62ce3c0ad68d
SHA512 9622636130f76fa240ae493f9d9f82bcae62e125860620f19d43c7301bbe6d2e3dff6ac32e0b153b909c1ef5000ac20b50f9afafed03ff3a102d348013dc2ff4
SSDEEP 49152:MnrNwH8k3ooJhNIT2tKA3158i8zbi5/V1OhJ4+JzUPD2itGvWVgLWxkf+VruWqTV:MZwHxS2tz315GhJWGvGnkql
TLSH
T13C46AF04BBF84E67D16FC275C4B14052ABF0F89EA323DBDB2581967A2D23B808D51767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

38.240.49.194:4782

Mutex

e91610cd-5b8c-4842-9f35-3462621ed2b9

Attributes

encryption_key
C234496C7B0ABCD873BB6BB5A54288B6D340B6FF
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Nat2 Client Startup
subdirectory
SubDir

Targets

- Target
  2026-10-19_91b02f2215985ae08c15f2712b8bfe74_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_mass-logger_ngrbot_njrat_poet-rat_quasar-rat_vidar_xrat
- Size 5.3MB
- SHA256 24902459acade2d7ea5b85bb110defa5b45e4459a30a36f5ef6cdaa53dc682b1
- MD5 91b02f2215985ae08c15f2712b8bfe74
- SHA1 e4d9c721e5cc9436b5de03a4d79a62ce3c0ad68d
- SHA512 9622636130f76fa240ae493f9d9f82bcae62e125860620f19d43c7301bbe6d2e3dff6ac32e0b153b909c1ef5000ac20b50f9afafed03ff3a102d348013dc2ff4
- SSDEEP 49152:MnrNwH8k3ooJhNIT2tKA3158i8zbi5/V1OhJ4+JzUPD2itGvWVgLWxkf+VruWqTV:MZwHxS2tz315GhJWGvGnkql
- TLSH
  T13C46AF04BBF84E67D16FC275C4B14052ABF0F89EA323DBDB2581967A2D23B808D51767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

office04 discovery execution quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables containing common artifacts observed in infostealers
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
- Detects executables referencing many email and collaboration clients. Observed in information steale
- Detects executables referencing many file transfer clients. Observed in information stealers
- Executes dropped EXE
behavioral1 behavioral2