quasar | 278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772 | Triage

Submit
Reports

Overview

overview

Static

static

278f8ab35d...72.exe

windows7-x64

278f8ab35d...72.exe

windows10-2004-x64

Sharing

General

Target

278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772
Size

3.1MB
Sample

240618-ydt1vsvfre
MD5

d31d13edf1b0218c3abd9d2aa56d70ef
SHA1

bbd910ab3e07db504df3ac3e427e2fac66dd4133
SHA256

278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772
SHA512

6b8a41a51a4d6f5c9ce909567a0c85e6429be61113301057d4f54c6f8243d1d237c6afafc75430f98c3fdd7604363888dadfb452e3ff805a408b424c38d30677
SSDEEP

49152:WvbI22SsaNYfdPBldt698dBcjHksN6fBxQRoGdTTHHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHB62

Score

10^/10

quasar office04 spyware trojan

Static task

static1

office04 quasar

6 signatures

Behavioral task

behavioral1

Sample

278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772.exe

Resource

win7-20231129-en

quasar office04 spyware trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772.exe

Resource

win10v2004-20240508-en

quasar office04 spyware trojan

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.112:4782

Mutex

0355605d-7aa8-4c93-be89-20f64f2705f9

Attributes

encryption_key
123371CC562DEA62C4475E1D6A3DEEAA00328E0D
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772
- Size
  
  3.1MB
- MD5
  
  d31d13edf1b0218c3abd9d2aa56d70ef
- SHA1
  
  bbd910ab3e07db504df3ac3e427e2fac66dd4133
- SHA256
  
  278f8ab35d9c561634e5a9ea51dbd1634abb2c5a6fdb58fd8aeb769de7500772
- SHA512
  
  6b8a41a51a4d6f5c9ce909567a0c85e6429be61113301057d4f54c6f8243d1d237c6afafc75430f98c3fdd7604363888dadfb452e3ff805a408b424c38d30677
- SSDEEP
  
  49152:WvbI22SsaNYfdPBldt698dBcjHksN6fBxQRoGdTTHHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHB62
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Detects Windows executables referencing non-Windows User-Agents
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
- Detects executables containing common artifacts observed in infostealers
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

quasaroffice04spywaretrojan

behavioral2

quasaroffice04spywaretrojan

© 2018-2024

Terms | Privacy