Severity
Medium
Analysis Summary
Quasar malware is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users' computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.
The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.
Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:
- Viewing and manipulating files on the victim's computer
- Recording keystrokes and stealing login credentials
- Taking screenshots and recording audio and video from the victim's webcam and microphone
- Installing other malware or tools to further compromise the victim's computer or network
- Using the victim's computer as a part of a botnet to launch attacks on other targets
To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.
Impact
- Data Theft
- Exposure to Sensitive Data
Indicators of Compromise
MD5
e98618369739a06a533af5131bf2e472
ca805b525f2c4b258a7c79e4c3b9047b
7fe9626020bc948478ff3b5c89d62ecc
8a9f83605f463b549cd71f353de9e466
SHA-256
101786e62aeb6f62129bb39ea1b58cc587de9483a2409a1c95a61a32aa202627
f6408f2aba1a49dbd77fb7c44fbf73f3dfc31b3d01dae867d061fa1cf43623f0
9367d8520bf58974c905eac5bff5b8587512858b80c501570c9f667fd66489d5
c48de72e3d33017a1573ea1a470aa3098a8eb3a533f08127be53a44698fb8582
SHA1
a0b759725f01dbfeb2c0efac14729e6d806eedad
f3471610bab7721e342303a7c7be35c8adff46e4
429cf26a96caefc7ab263ca140f077e837696492
55cfebddd8c7b78efadf763ed071322d2c376fdd
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not open emails and attachments from unknown or suspicious sources.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.