

ICS: Multiple Siemens Products Vulnerabilities
January 17, 2025
Massive Attack Targets 5,000 WordPress Sites with Fake Admin Accounts – Active IOCs
January 17, 2025
ICS: Multiple Siemens Products Vulnerabilities
January 17, 2025
Massive Attack Targets 5,000 WordPress Sites with Fake Admin Accounts – Active IOCs
January 17, 2025Severity
Medium
Analysis Summary
Quasar malware is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users' computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.
The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.
Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:
- Viewing and manipulating files on the victim's computer
- Recording keystrokes and stealing login credentials
- Taking screenshots and recording audio and video from the victim's webcam and microphone
- Installing other malware or tools to further compromise the victim's computer or network
- Using the victim's computer as a part of a botnet to launch attacks on other targets
To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.
Impact
- Data Theft
- Exposure to Sensitive Data
Indicators of Compromise
MD5
aebbee96c927750b5c6eec97940acc19
4e7b96fe3160ff171e8e334c66c3205c
ff8c68c60f122eb7f8473106d4bcf26c
7ced1e3728202bb14170fdbcde4f69b2
SHA-256
0ffa441a13f140ff08492899f44d4d30288f193e68a1affcc0d62e617d1532cd
e698a786c4dcd964e54903a98bfaa0638ce8f52e02658f1223805c6e3b1ca83c
5ff2becf2c56500cb71898f661c863e647a96af33db38d84d7921dc7dbf4f642
3bee4d2ab33ac3f0605136f09cba556140d62ce9a0c1bdb1639159b43ae58943
SHA1
fea20780c2b137ecea31544aa089f67ba4672ffd
ad9dbdfb52d3c2ee9a57fe837605ec233db43a7f
0efa03e7412e7e15868c93604372d2b2e6b80662
bf67ce43accf497ffa74caa94a5c09209b974f07
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not open emails and attachments from unknown or suspicious sources.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.