✕
Request a Demo
Rewterz
Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
December 22, 2021
Rewterz
Rewterz Threat Alert – Qakbot (Qbot) Malware – Active IOCs
December 22, 2021

Rewterz Threat Alert – Quasar RAT – Active IOCs

Severity

Medium

Analysis Summary

Quasar virus is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users’ computers for malicious purposes. Exploiting a path traversal vulnerability of WinRAR, a Molerats spear-phishing campaign is discovered. It is suspected that a Gaza Cyber gang group is behind the campaign. In the first step, the victim installs a downloader in their operating system which then gets infected with a RAT (Quasar). The downloader typically first tries to connect to a geolocation domain and then the RAT is downloaded.

Impact

  • Data Theft
  • Exposure of Sensitive DatA

Indicators of Compromise

MD5

  • ee8a5f22013aace16498c3e673adab19
  • 9b429de992f2ff70099c2805274fc475
  • c599f45fd550301593675b711cec0794

SHA-256

  • 05cd8a20481b09124861cc696e06bf938d763141d41752e51c0d048d6021ceac
  • 72b94be0f805d7473eb435add6f58f5c78a734f579a82701bb8d1b4f6f9e580d
  • e446be684f7fc7fc674dfdceeb49838087dad15a282dd047ef15b13f581549d7

SHA-1

  • c0594736ef8dbf2a962eaf1240e085cb5354acb1
  • 9a2ebe780a29b83dd9cfae462f35fd5f697889d2
  • a8e3d27e14d044ee2bc771a1ccb195eac78b4b95

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Search for IOCs in your environment.