March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – FormBook Malware – Active IOCs
February 15, 2024
Rewterz Threat Advisory – Multiple Dell PowerProtect Data Manager Vulnerabilities
February 15, 2024
Rewterz Threat Alert – FormBook Malware – Active IOCs
February 15, 2024
Rewterz Threat Advisory – Multiple Dell PowerProtect Data Manager Vulnerabilities
February 15, 2024
Severity
Medium
Analysis Summary
Quasar virus is a Remote Access Trojan (RAT) that is often abused by cybercriminals to take remote control over users’ computers for malicious purposes. The Quasar RAT was first discovered in 2015 and is known for its ability to evade detection by most anti-virus software.
The Quasar RAT is typically spread through phishing emails or other social engineering tactics. Once a victim clicks on a malicious link or downloads a malicious file, the Quasar RAT will be installed on their computer without their knowledge.
Once installed, the Quasar RAT allows the attacker to perform a variety of malicious actions, including:
- Viewing and manipulating files on the victim’s computer
- Recording keystrokes and stealing login credentials
- Taking screenshots and recording audio and video from the victim’s webcam and microphone
- Installing other malware or tools to further compromise the victim’s computer or network
- Using the victim’s computer as a part of a botnet to launch attacks on other targets
To protect against the Quasar RAT and other similar types of malware, it is important to practice good cybersecurity habits, such as avoiding suspicious emails and links, keeping anti-virus software up-to-date, and regularly backing up important files.
Impact
- Data Theft
- Exposure to Sensitive Data
Indicators of Compromise
Domain Name
- myhostter.ddns.net
MD5
- cc5786ff3a21273c9504e0a6ee1f23ed
- 18271e44f036cf721163ec98e956aeaa
SHA-256
- 0b5e901d7b6bf73a49de04a246299490f217793a465e85daf449e1eac3d2902f
- d195c628016a467a86fb3036e77b2a0d3e8bc2acec9cbd5b87afaaee216162c2
SHA-1
- 0599a385df3912634877c18049eebcff2c2e0b38
- 6df11b53bdb3a47fbd7d0d180ad58f3181f6caac
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls.
- Emails from unknown senders should always be treated with caution.
- Never trust or open links and attachments received from unknown sources/senders.
- Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.
- Patch and upgrade any platforms and software on time and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.