quasar | 41ca427689b867b9cd616f1c82cc4b24c5fe87c43fd5fc44c362628d86205ee3

General

Target
meow.bat
Size 883KB
Sample261103-yft4msct4v
SHA256 41ca427689b867b9cd616f1c82cc4b24c5fe87c43fd5fc44c362628d86205ee3
MD5 94e82ab6884954aa6229ade9444258f2
SHA1 2795675ee8f4fcaa535cf850d69e604272ee1742
SHA512 70eb92de233d66cf76d3673b74d629882c319b63bd48c98f17ba2c6e3b1b28a13b023fcb1bdb4e07f384c4f8c661a21568f0cca6ac7dbacf98c5843499189264
SSDEEP 24576:hx8V2hBexUqKmS5Y5FBBtA2uoRYF8wtoXmC4Z:hKoXmxbcHvH3
TLSH
T17B1523FCE2AE535F4F14A7F3B916AC0BB1C562420E431679137D8E01B0E24BBAF5159A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
whLO7d+OjCDKv/daFcqtI0HB6dG03cOoIFALIGIH1DCvxaqk
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  meow.bat
- Size 883KB
- SHA256 41ca427689b867b9cd616f1c82cc4b24c5fe87c43fd5fc44c362628d86205ee3
- MD5 94e82ab6884954aa6229ade9444258f2
- SHA1 2795675ee8f4fcaa535cf850d69e604272ee1742
- SHA512 70eb92de233d66cf76d3673b74d629882c319b63bd48c98f17ba2c6e3b1b28a13b023fcb1bdb4e07f384c4f8c661a21568f0cca6ac7dbacf98c5843499189264
- SSDEEP 24576:hx8V2hBexUqKmS5Y5FBBtA2uoRYF8wtoXmC4Z:hKoXmxbcHvH3
- TLSH
  T17B1523FCE2AE535F4F14A7F3B916AC0BB1C562420E431679137D8E01B0E24BBAF5159A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution quasar module rat spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- PulsaRAT library module
  Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.
  rat module
- Quasar payload
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

PulsaRAT library module

Quasar payload

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2