quasar | ce5c1b2bc378e48dbef06ca2bdba45318c65a7b7972d6a2beed6789dde371a5f

General

Target
Raven Stealer v1.3.exe
Size 5.5MB
Sample261025-a1bk2aey8k
SHA256 ce5c1b2bc378e48dbef06ca2bdba45318c65a7b7972d6a2beed6789dde371a5f
MD5 fd80b989566dda10cd8f98ab38023ceb
SHA1 ccfaad8751ae99e6b7cea2ae7fe0613a67f54c9c
SHA512 e43e934d16c2c46c366164535acc198b84b4134c399a16f00dede4d439d04efe335d7c786a1d6c11c91129143e4e01a5051fc36d82030b994174dd774093f0c4
SSDEEP 98304:UL1UueesVQ0ZNd/tziosUjMoT+nyyQyCdGV65A1cSzDgPtcn4B0jp6e/CQK46vPs:OoVQ0d1z/JKt8AqS3g+nw096e/CBPFk9
TLSH
T11246335673A96213DA7EBA39034B536DF2BAD14378320603C75CA398CEED0E791639C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RuntimeBroker

C2

RDBRO-34427.portmap.host:34427

Mutex

d43d3b35-c772-40f6-b5cf-f1814d282af0

Attributes

encryption_key
D9AA1128BAE5392DD0EB40CA054C3D046A7F9712
install_name
svh0st.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
RuntimeBroker
subdirectory
SubDir

Targets

- Target
  Raven Stealer v1.3.exe
- Size 5.5MB
- SHA256 ce5c1b2bc378e48dbef06ca2bdba45318c65a7b7972d6a2beed6789dde371a5f
- MD5 fd80b989566dda10cd8f98ab38023ceb
- SHA1 ccfaad8751ae99e6b7cea2ae7fe0613a67f54c9c
- SHA512 e43e934d16c2c46c366164535acc198b84b4134c399a16f00dede4d439d04efe335d7c786a1d6c11c91129143e4e01a5051fc36d82030b994174dd774093f0c4
- SSDEEP 98304:UL1UueesVQ0ZNd/tziosUjMoT+nyyQyCdGV65A1cSzDgPtcn4B0jp6e/CQK46vPs:OoVQ0d1z/JKt8AqS3g+nw096e/CBPFk9
- TLSH
  T11246335673A96213DA7EBA39034B536DF2BAD14378320603C75CA398CEED0E791639C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

runtimebroker discovery execution quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2
- Target
  Raven Stealer v1.3.exe
- Size 9.1MB
- SHA256 fff53d4340f5b3355a0aa7916952bb0fba0a0528f65ed08e03024a86df98bb1e
- MD5 28ef4aa2a96631c77bcf57622ef58ed3
- SHA1 53a627881ec0aa404432e2da6278a162175a3be1
- SHA512 2c602e0163e62602b5cda03ff1b145d7f6e0f9b37782cbdb51e7006972a61c5d0b9c9e953fa43f4ba35f3e9c1433ae8b2833c7a493c833be9c9ef0bacd2bacb1
- SSDEEP 98304:W2UOuASsI8jbSTKAh1ozRJVm0rmMV0/k/cfP5+lRBgDW:yMUWRJlrmMVukUH0l/gC
- TLSH
  T1A1A6AE3276C240ABE0F7B97029A6AE945C377A12D575EB8B6ED04E4C4F3B5101CE76C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery raven_stealer stealer
- Detects RavenStealer Payload
- Family: RavenStealer
  RavenStealer is a stealer written C++.
  stealer raven_stealer
behavioral3 behavioral4