General
- Target 2026-11-02_ebc45ea921700e63811baf5327a255f4_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_mass-logger_ngrbot_njrat_poet-rat_quasar-rat_vidar_xrat
- Size 5.3MB
- Sample261102-xs7d3agb54
- SHA256 e35919f0d1eaf55b42c9a6278eb1be58502b8f88907e6c78b068eb32d9ebd715
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.0.0
Botnet
-
Office04
C2
-
bore.pub:48248
Mutex
-
2b550e0c-0409-42d2-a39d-1f28b079235c
Attributes
-
encryption_key
112EF928451E2D8E49CBF356E45023F162738F78
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Prisma Client Startup
-
subdirectory
SubDir
Targets
-
- Target 2026-11-02_ebc45ea921700e63811baf5327a255f4_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_luca-stealer_mass-logger_ngrbot_njrat_poet-rat_quasar-rat_vidar_xrat
- Size 5.3MB
- SHA256 e35919f0d1eaf55b42c9a6278eb1be58502b8f88907e6c78b068eb32d9ebd715
Score10/10-
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables containing common artifacts observed in infostealers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
-
Detects executables referencing many email and collaboration clients. Observed in information steale
-
Detects executables referencing many file transfer clients. Observed in information stealers
-
Executes dropped EXE