[ALL_FAMILIES]

BlotchyQuasar

rat1 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:
BlotchyQuasar
CATEGORY:
RAT
DESCRIPTION:
BlotchyQuasar (NUCLEAR RAT) is a remote access trojan used by the Hive0129 threat group to target financial institutions in Latin America. It is designed as a banking trojan that provides attackers with remote control capabilities over compromised systems and uses specific mutexes to ensure single instance execution.
ALIASES:
NUCLEAR RAT
TAGS:
remote_accessbanking_trojanfinancial_targetinglatamhive0129windows

[MUTEX_SIGNATURES](1)

[MUTEX_01]
44474877AKs8XXT4SylAo2kAlUS2kYkala!
ANALYST: @adhikara13 DATE: 2024-12-19

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:
Hive0129
FIRST_OBSERVED:
2024

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:1
THREAT_ACTORS:1
ALIASES:1
TAGS:6
CATEGORY:RAT
Malware profile loaded successfully

EvilMutex Project v1.0.0

Open Source Threat Intelligence Database