quasar | cde1b350791fbef921b7bc2241e74820f8f8c3bb12910d501e201de4df407c6c | Triage

Submit
Reports

Overview

overview

Static

static

e026a06e96...63.exe

windows7-x64

e026a06e96...63.exe

windows10-2004-x64

Sharing

General

Target

e026a06e96e80ad0a4c72b7ebe9a4a63.bin
Size

3.1MB
Sample

240701-edpxcsydqm
MD5

e026a06e96e80ad0a4c72b7ebe9a4a63
SHA1

c10e4ab92083ed4c1c64494a10c3fb71881a78a0
SHA256

cde1b350791fbef921b7bc2241e74820f8f8c3bb12910d501e201de4df407c6c
SHA512

a613cb2777bdcd471414f0d83e69be0b84446c2810b73156cc385c92eb437ef93950581d840a8d89e0e78ccaab3d817389b4ddc2dd8eb13a988d4e94cf852617
SSDEEP

49152:PvTlL26AaNeWgPhlmVqvMQ7XSKnVWDgdhLvJwCoGdyTHHB72eh2NT:PvJL26AaNeWgPhlmVqkQ7XSK9hL

Score

10^/10

quasar office04 spyware trojan

Static task

static1

office04 quasar

3 signatures

Behavioral task

behavioral1

Sample

e026a06e96e80ad0a4c72b7ebe9a4a63.exe

Resource

win7-20231129-en

quasar office04 spyware trojan

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

e026a06e96e80ad0a4c72b7ebe9a4a63.exe

Resource

win10v2004-20240611-en

quasar office04 spyware trojan

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

performance-ha.gl.at.ply.gg:33365

Mutex

ba5220e2-c4e8-4381-aad8-a85115ef955e

Attributes

encryption_key
67C139F3E9A16FF8132A3DCF42197B8BA3C38609
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  e026a06e96e80ad0a4c72b7ebe9a4a63.bin
- Size
  
  3.1MB
- MD5
  
  e026a06e96e80ad0a4c72b7ebe9a4a63
- SHA1
  
  c10e4ab92083ed4c1c64494a10c3fb71881a78a0
- SHA256
  
  cde1b350791fbef921b7bc2241e74820f8f8c3bb12910d501e201de4df407c6c
- SHA512
  
  a613cb2777bdcd471414f0d83e69be0b84446c2810b73156cc385c92eb437ef93950581d840a8d89e0e78ccaab3d817389b4ddc2dd8eb13a988d4e94cf852617
- SSDEEP
  
  49152:PvTlL26AaNeWgPhlmVqvMQ7XSKnVWDgdhLvJwCoGdyTHHB72eh2NT:PvJL26AaNeWgPhlmVqkQ7XSK9hL
Score

10^/10

quasar office04 spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

quasaroffice04spywaretrojan

behavioral2

quasaroffice04spywaretrojan

© 2018-2024

Terms | Privacy