Severity
Medium
Analysis Summary
Quasar malware is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users' computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.
The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.
Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:
- Viewing and manipulating files on the victim's computer
- Recording keystrokes and stealing login credentials
- Taking screenshots and recording audio and video from the victim's webcam and microphone
- Installing other malware or tools to further compromise the victim's computer or network
- Using the victim's computer as a part of a botnet to launch attacks on other targets
To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.
Impact
- Data Theft
- Exposure to Sensitive Data
Indicators of Compromise
MD5
32a4a959228688f6fbe1a5af3d18cfb5
108604569ba15d3ffa7c1804949a84b8
359adddad264be60f1551dff00fff993
SHA-256
2312ed59a38d03b9035719369af00c1d3b36dc1db24de8833124bced3a9d5815
6d18b4d77e47730827db5db6476171eecaaa41794b2e7ae3947c0310603deff7
e673f2b5113583931f11a5a3ca8718afc4524431c1bed36a515e87b85025001c
SHA1
5fe1e21e718a878b845e2fc9673c9b4c6dd91146
c737db60763ad779d8d414cb8d1cd86b62fa374e
22605a00f6980ada8bd62d930231042a50036f6d
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not open emails and attachments from unknown or suspicious sources.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.