Advanced Phishing Campaign Delivers Quasar RAT

guest · Aug 26, 2019

Advanced Phishing Campaign Delivers Quasar RAT
August 26, 2019
https://cofense.com/advanced-phishing-campaign-delivers-quasar-rat/

Cofense IntelligenceTM has uncovered an advanced campaign that uses multiple anti-analysis methods to deliver Quasar Remote Access Tool (RAT). A phishing email poses as a job seeker and uses the unsophisticated ploy of an attached resume to deliver the malware.

A US-Cert report states that Quasar RAT “has been observed being used maliciously by Advanced Persistent Threat (APT) actors to facilitate network exploitation,” however, Quasar is also “a publicly available, open-source RAT” and can be found on GitHub.
Since the tool is easily accessible, attributing the activity to a specific threat actor is tedious at best.

The last significant step the threat actors take to avoid discovery is to download a Microsoft Self Extracting executable. This executable then unpacks a Quasar RAT binary that is 401MB.
By using an artificially large file size the threat actors make sharing information difficult while also causing problems for automated platforms that attempt to statically analyze the content.
Click to expand...

Log in or Sign up

Advanced Phishing Campaign Delivers Quasar RAT

guest Guest

Log in or Sign up

Advanced Phishing Campaign Delivers Quasar RAT

guest Guest

Useful Searches