Rewterz Threat Alert –Quasar RAT – Active IOCs

Severity

Medium

Analysis Summary

Quasar virus is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users’ computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.

The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.

Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:

• Viewing and manipulating files on the victim’s computer
• Recording keystrokes and stealing login credentials
• Taking screenshots and recording audio and video from the victim’s webcam and microphone
• Installing other malware or tools to further compromise the victim’s computer or network
• Using the victim’s computer as a part of a botnet to launch attacks on other targets

To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.

Impact

• Data Theft
• Exposure to Sensitive Data

Indicators of Compromise

MD5

• 2b78cbb69c4f6feb4738f5465d5bbc2b
• a8a6182341c07e476d3b2e4ae24fbb14
• a9c65aeada0779aab074784a9189cfe1
• c3254cfdf3f5a1fc5beb98925f5088a9
• 43e4ab95f71fff3318e1de5ef613e42c

SHA-256

• 638427e622c7af9deedc65183f58fc0c5d64c8ba1161d20061585429b4f4bc90
• c8d0b4ca7be51d58dbf4c9544103d15733007cef9e5515730d357d25dc7737b0
• e71ad815cd54594816cf7b66db9418eeab73bbc0b67f6ff22d45f7383418a001
• 9d9569779e888ebb01de2dee260d89d285b949d72b7bf1c63131ee294144fd34
• 84373ebec135e57078d86662414d1c39fa6def544ea4152f703489fb171a1900

SHA-1

• eb0f114b529ec37e900521c853076cd4ee6e13fb
• 6ca4db6b3dfde588b8454192c4a6aa5c7f3915fe
• 518a53e34aef6bc34d6e21574a15087a99ed43b8
• 119e8200a24c1ef145fc13d059e6a5495876aec4
• c77452fb0b08eb0c37bb51edff7aa2be45296ea5

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not open emails and attachments from unknown or suspicious sources.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets