Severity
Medium
Analysis Summary
Quasar malware is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users' computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.
The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.
Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:
- Viewing and manipulating files on the victim's computer
- Recording keystrokes and stealing login credentials
- Taking screenshots and recording audio and video from the victim's webcam and microphone
- Installing other malware or tools to further compromise the victim's computer or network
- Using the victim's computer as a part of a botnet to launch attacks on other targets
To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.
Impact
- Data Theft
- Exposure to Sensitive Data
Indicators of Compromise
MD5
fc122ee0eaf2bdb301c5aae38f90b880
d66685c1ff0ea4e93724b4e86459a8a0
0f3ef8549ed721e4554e14d1af8d5846
bc1268d92af4fa96a5ab483bf8c44a3c
6380839d1cdf7b795ec79e352140892b
SHA-256
4836401b560c601de78fea1467813078d4829863c6b41f0019ea79080f30381c
e8b13c084533e4ae24ea404d7bd849554af93071e62c61ef47f7f98cd8d62e31
fc10f366564e61290add3a2002142b7a6f24c5a434ed1201d671b32d8ef9f84b
a4c36a7fde33b069aa436c820d1dae65fdf29c18badef68d9e010fe8f4f13435
bed0d15d8fdecc0f9ef6d51cf68e2bbe494ff77ac87d9e0315728268a8676488
SHA1
3336cb19940f62e74e8430a5d1c2afc1eaec41b4
cf66fff1c1d02e0b19fd8faab55930d0ea499df0
8b9b82510518b0cde337ad76f196dd48983b5aa3
58ae987ebc0dca1843b59ef64599cdde8c792ae6
4b9bd29ea460587904dc58dcabb946f97a5de829
Remediation
- Block all threat indicators at your respective controls.
- Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Do not open emails and attachments from unknown or suspicious sources.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.