March 11, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
December 22, 2021Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
December 22, 2021Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
December 22, 2021Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
December 22, 2021
Severity
Medium
Analysis Summary
Quasar virus is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users’ computers for malicious purposes. Exploiting a path traversal vulnerability of WinRAR, a Molerats spear-phishing campaign is discovered. It is suspected that a Gaza Cyber gang group is behind the campaign. In the first step, the victim installs a downloader in their operating system which then gets infected with a RAT (Quasar). The downloader typically first tries to connect to a geolocation domain and then the RAT is downloaded.
Impact
- Data Theft
- Exposure of Sensitive DatA
Indicators of Compromise
MD5
- ee8a5f22013aace16498c3e673adab19
- 9b429de992f2ff70099c2805274fc475
- c599f45fd550301593675b711cec0794
SHA-256
- 05cd8a20481b09124861cc696e06bf938d763141d41752e51c0d048d6021ceac
- 72b94be0f805d7473eb435add6f58f5c78a734f579a82701bb8d1b4f6f9e580d
- e446be684f7fc7fc674dfdceeb49838087dad15a282dd047ef15b13f581549d7
SHA-1
- c0594736ef8dbf2a962eaf1240e085cb5354acb1
- 9a2ebe780a29b83dd9cfae462f35fd5f697889d2
- a8e3d27e14d044ee2bc771a1ccb195eac78b4b95
Remediation
- Block all threat indicators at your respective controls.
- Always be suspicious about emails sent by unknown senders.
- Never click on the links/attachments sent by unknown senders.
- Search for IOCs in your environment.