Malware

Quasar RAT

Also known as: CinaRAT · QuasarRAT · Yggdrasil

Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.

Indicators of Compromise 23

Domain archive[.]org Domain begalinokotobananinotrippitroppacrocofanclub[.]su Domain m-vn[.]ws Domain myaunet[.]su Domain paste[.]ee Domain solidity[.]bot Filename 1.txt Filename 2.txt Filename 3.txt Filename Launch.exe Filename a.txt Filename a.vbs Filename extension.zip Filename myau.exe Filename myaunet.exe Filename wmam.exe SHA-256 209fb5bb2440ffe1a631dfe3b574229105a33c5153eded023cc77d8e8f81d1de SHA-256 a1eadd41327bd8736e275627d3953944fe7089c032d72a3e429ff18ad0958ada SHA-256 c3684164933c3f54d5b0b242a8a906a85d633de479079a820bb804c0f73c0f58 SHA-256 c5c0228a1e0ba2bb748219325f66acf17078a26165b45728d8e98150377aa068 SHA-256 ce72b79e324371134db762fe70b8b1789af899d7217461bc3658a6bd84743eb6 SHA-256 e0ca66c1a9a68b319b24a7c6b8fdca219dffd802dd4de2d59f602c4d90f40d6c SHA-256 e19d5d8f941b9a98fbb3b65e1e6077fa00d97529e351e455297b0204ec07e9ed

MITRE ATT&CK TTPs 25

T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1074
Data Staged
Collection
 T1082
System Information Discovery
Discovery
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1112
Modify Registry
Defense Evasion
 T1129
Shared Modules
Execution
 T1137
Office Application Startup
Persistence
 T1140
Deobfuscate/Decode Files or Information
Defense Evasion
 T1176
Browser Extensions
Persistence
 T1197
BITS Jobs
Defense Evasion
 T1204.002
Malicious File
Execution
 T1211
Exploitation for Defense Evasion
Defense Evasion
 T1218.011
Rundll32
Defense Evasion
 T1484.001
Group Policy Modification
Defense Evasion
 T1497.001
System Checks
Defense Evasion
 T1547.001
Registry Run Keys / Startup Folder
Persistence
 T1553.005
Mark-of-the-Web Bypass
Defense Evasion
 T1566
Phishing
Initial Access
 T1570
Lateral Tool Transfer
Lateral Movement
 T1571
Non-Standard Port
Command And Control
 T1573
Encrypted Channel
Command And Control
 T1574.002
DLL Side-Loading
Persistence
 T1595.002
Vulnerability Scanning
Reconnaissance

Source Articles

The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions | Datadog Security Labs
MUT-9332 is a threat actor targeting Solidity developers via malicious Visual Studio Code extensions named solaibot, among-eth, and blankebesxstnion. These extensions deliver multi-stage malware that establishes persistence, disables security controls, and exfiltrates cryptocurrency wallet credentials. The campaign uses obfuscated scripts, steganography, and multiple command-and-control domains to evade detection, with infrastructure reuse indicating links to a prior Monero cryptominer campaign.
Datadog Security Labs