Quasar.v1.4.1.zip
- SHA256 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
Overview
overview
10Static
static
10Quasar v1....e.html
windows11-21h2-x64
1Quasar v1....to.dll
windows11-21h2-x64
1Quasar v1....ok.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....ks.dll
windows11-21h2-x64
1Quasar v1....il.dll
windows11-21h2-x64
1Quasar v1....at.dll
windows11-21h2-x64
1Quasar v1....on.dll
windows11-21h2-x64
1Quasar v1....ar.exe
windows11-21h2-x64
10Quasar v1....ib.dll
windows11-21h2-x64
1Quasar v1....nt.exe
windows11-21h2-x64
10Quasar v1....et.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win11-20240214-en
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Quasar.exe
Resource
win11-20240214-en
windows11-21h2-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Quasar v1.4.1/client.exe
Resource
win11-20240214-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win11-20240214-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target Quasar.v1.4.1.zip
- Size 3.3MB
- Sample240221-js8egadb7w
- SHA256 4cdeb2eae1cec1ab07077142313c524e9cf360cdec63497538c4405c2d8ded62
- MD5 13aa4bf4f5ed1ac503c69470b1ede5c1
- SHA1 c0b7dadff8ac37f6d9fd00ae7f375e12812bfc00
- SHA512 767b03e4e0c2a97cb0282b523bcad734f0c6d226cd1e856f6861e6ae83401d0d30946ad219c8c5de3c90028a0141d3dc0111c85e0a0952156cf09e189709fa7d
- SSDEEP 49152:lYLmNgMh/9yUsRFeWMyYISDSwtfxZQNemi57PdHmeFINp/lFnsDbNFNepL6DJo+J:mL9U1yUUQykOQ91XFYBlR8P9d5uNJo9
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
quasar
Attributes
-
reconnect_delay
5000
Signatures
- Quasar family
- Quasar payload 3 IoCs
resource yara_rule static1/unpack001/Quasar v1.4.1/Quasar.Common.dll family_quasar static1/unpack001/Quasar v1.4.1/Quasar.exe family_quasar static1/unpack001/Quasar v1.4.1/client.bin family_quasar - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/Quasar v1.4.1/Gma.System.MouseKeyHook.dll unpack001/Quasar v1.4.1/Mono.Cecil.Mdb.dll unpack001/Quasar v1.4.1/Mono.Cecil.Pdb.dll unpack001/Quasar v1.4.1/Mono.Cecil.Rocks.dll unpack001/Quasar v1.4.1/Mono.Cecil.dll unpack001/Quasar v1.4.1/Open.Nat.dll unpack001/Quasar v1.4.1/Quasar.Common.dll unpack001/Quasar v1.4.1/Quasar.exe unpack001/Quasar v1.4.1/Vestris.ResourceLib.dll unpack001/Quasar v1.4.1/client.bin unpack001/Quasar v1.4.1/protobuf-net.dll
File Explorer
-
Quasar.v1.4.1.zip.zip 3.3MB
-
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt1KB
-
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html.html 1KB
-
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt1KB
-
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt1KB
-
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt1KB
-
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt1KB
-
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt75B
-
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt831B
-
Quasar v1.4.1/BouncyCastle.Crypto.dll.dll 3.2MB
-
Quasar v1.4.1/Gma.System.MouseKeyHook.dll.dll 56KB
-
Quasar v1.4.1/LICENSE1KB
-
Quasar v1.4.1/Mono.Cecil.Mdb.dll.dll 42KB
-
Quasar v1.4.1/Mono.Cecil.Pdb.dll.dll 87KB
-
Quasar v1.4.1/Mono.Cecil.Rocks.dll.dll 27KB
-
Quasar v1.4.1/Mono.Cecil.dll.dll 350KB
-
Quasar v1.4.1/Open.Nat.dll.dll 68KB
-
Quasar v1.4.1/Quasar.Common.dll.dll 62KB
-
Quasar v1.4.1/Quasar.exe.exe 1.2MB
-
Quasar v1.4.1/Quasar.exe.config.xml 176B
-
Quasar v1.4.1/Vestris.ResourceLib.dll.dll 76KB
-
Quasar v1.4.1/client.bin.exe 3.1MB
-
Quasar v1.4.1/protobuf-net.dll.dll 282KB
Quasar v1.4.1/3rdPartyLicenses/Be.HexEditor_license.txt
- SHA256 d691ba20526ed297dbabfd8beec2ef0dd2ee769783152ba5bcb9eb5037435efb
- MD5 0a5c19336b04e958b8e528d66a61d048
- SHA1 193042c0933223eaaa488a1cc61f41b1ec754a7c
- SHA512 79360909b329492a70c73c8bd2c031042ee73917e7092964cdd2a08cdfda237decdb2afe51214d30673f5d57826d60f61b424d4f573fcf168cce2d1ff9a46c51
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
- SHA256 6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
- MD5 bf8d5a737e70dd3493a475b8672f14df
- SHA1 01d35be1b65293f7ca43ee1045424599923ab54a
- SHA512 ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/GlobalMouseKeyHook_license.txt
- SHA256 701a899c1bed0dfc8279ac2ba71696a65dba68df5f8e09fc1d18014b3cbb7d77
- MD5 33c823163dce377d283d80c9d7d29de4
- SHA1 6dc58ca71650f640cd7f0901ec33a94dcdbf7f44
- SHA512 5cb523b233213779942290c1aa63e2cad22e85fcfc00e17ab60a074a9ed4989f70e7cc4afc4c6e8fcc98be4febf76b7f6a2232e5b41eb4ab96ef99d259242352
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/Mono.Cecil_license.txt
- SHA256 62dad7936fc1214d0187b1dd27bd68ec055af168b7fd1989cc8e36e0e2b9a990
- MD5 4cc72ae97c8b623bd69a4de2539f9728
- SHA1 4d44f4eeaa018e77c91041b5d10c33ac9ddcad98
- SHA512 0247a33d7b28dbe3b88cd937f47aa58e10c6323ff484ce8a4676cf79c38851379d972ed5d193c65cf361ee2457578660834cce530c3834c5e868df6013aa2bac
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/Open.Nat_license.txt
- SHA256 d9e507ef9edf463eaf893160f087a1c1a5325147ddd2c9a14c745454eb676ded
- MD5 e306664d753023ca56dbca39110ae1c4
- SHA1 3199b9260659db4b366264ff8720a06fde47c9f9
- SHA512 cafc86d5ae3c73af236f53e2d6e20dc364f1a6ee032653ac6d6747dc2fa76a6464df5c2abc278dfaab407f9e3f96eaf64e690d7fb9b7f2ddbfccd833dda45229
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/ResourceLib_license.txt
- SHA256 2d4f0b0a61082bee4ded1e80664d228168ad379175ab930d7a00ecbce163b2ae
- MD5 26436010667b931ec76662b43577eaa2
- SHA1 d4dfb647d6664c86e181b2debe63b035ead59c11
- SHA512 c292594fed13e54e1ce48abe70cf2994dd98555a76ffd54c6266fae81072d9d598768873d6120580b3932e1141aa592415393eb812de825a8daa7857fdd01123
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/SilkIcons_license.txt
- SHA256 b9906cfef91131960adb0eecdd8a85dcba384a48de6613b237f2888ed92b3e12
- MD5 a2d0860b0ba326ecc54ba0b6f5e9bae6
- SHA1 ceb373c48097f533eb380295703c33986875237b
- SHA512 76e4816d787f81c9cebdc2b6f003b194b93dfa6575aefd1989b56282bd816fe1a756e46388843dfb69bed7f9682b65a3a02bdcf9f9267a7b8fb44bdc65be8972
- MD5 SHA1 SHA512
Quasar v1.4.1/3rdPartyLicenses/protobuf-net_license.txt
- SHA256 2b492575a689e98da5ced83d486a95c03d99f4a318cd4e8b04fe9c8dd53d8e51
- MD5 dfe8687c4f152ee2b14f9be8493fca9c
- SHA1 68015fa105f57af41c3cb7fa6313229dd0ca2bfc
- SHA512 eaf78cb22277343aa177773d6df41fa9f56b2c92172a1eaccd41d73482dceffd6bb1f95092c060d0d1f9b9c079084beb7aee3bc7b0a0f28876db3e8caf7b1476
- MD5 SHA1 SHA512
Quasar v1.4.1/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- MD5 SHA1 SHA512 SSDEEP
Digest
f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 19, 2021
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 18, 2020 - Mar 23, 2023
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
3221146
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
BouncyCastle.Crypto.pdb
mscoree
_CorDllMain
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef
- MD5 bfb3bd1cb571360435100bfa6ed2b997
- SHA1 1325e8dd76180a165117e04da4ee4a020e996880
- SHA512 ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15
- SSDEEP 768:qYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8G:VncoU48/AzPwYpNZ6rXJ8G
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
52410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\globalmousekeyhook\MouseKeyHook\obj\Debug\Gma.System.MouseKeyHook.pdb
mscoree
_CorDllMain
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/LICENSE
- SHA256 49a25b5003ae74dc02141ba8cd29e1515baf4a2bf8d783019cc2148e07688b9b
- MD5 2656bf9fcaf47fa043715bbd3b2f5134
- SHA1 5832164b16008d7396501f857f9f5f8799fd179c
- SHA512 4d8ca0fc4a8aca853925df5d93eeed1e7c232e1e3816fe096cf153bc6ff802258b7d7c58cbaab4817c3eb4acc7f888b0c622400783fdd3140c7fd954a40c095d
- MD5 SHA1 SHA512
Quasar v1.4.1/Mono.Cecil.Mdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
49118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Mono.Cecil.Pdb.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
- MD5 6d5eb860c2be5dbeb470e7d3f3e7dda4
- SHA1 80c76660b87c52127b1a7da48e27700f75362041
- SHA512 64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
- SSDEEP 1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
94982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb
mscoree
_CorDllMain
Name
.text
Size
85KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Mono.Cecil.Rocks.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- MD5 6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1 14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA512 0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP 384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
33574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Mono.Cecil.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- MD5 de69bb29d6a9dfb615a90df3580d63b1
- SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP 6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
362022
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\src\cecil\obj\Release\net40\Mono.Cecil.pdb
mscoree
_CorDllMain
Name
.text
Size
348KB
Virtual Size
347KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Open.Nat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
- MD5 cc6f6503d29a99f37b73bfd881de8ae0
- SHA1 92d3334898dbb718408f1f134fe2914ef666ce46
- SHA512 7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
- SSDEEP 768:sF6vHHLFkywkNh5qtHMjkCifoydVXw5FxusiolecziijiSvD+ZGFa4Pw6OdrGHUm:8GmyJNh0tbt3MLQ9W2rG0Ydd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75530
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Quasar.Common.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 de930a748e4dc08c851ba0a22afce8dcfd0f15f23b291f9306c8ef6ccd7460a2
- MD5 2185564051ea2e046d9f711ed3cd93ff
- SHA1 2f2d7fd470da6d126582ad80df2802aabd6c9cea
- SHA512 00af241c1f89b478e66d758db26ed0a413b690d695abf91211b5cbc3985133632327ea0fc41140bd61d02271b6aa278a8e8f539d8ca6ce94972aef50c1a9c868
- SSDEEP 768:hiF6Vg9HIxFMu9brfp0kUEb9k/pUHRfp0YDpb4rILMgYY44YYXINk6I+QyIFLwSu:h9Nc7firfS0kE5Ia8I4Z
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
70094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Quasar.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 43315abb9c8be9a39782bd8694a7ea9f16a867500dc804454d04b8bf2c15c51e
- MD5 12ebf922aa80d13f8887e4c8c5e7be83
- SHA1 7f87a80513e13efd45175e8f2511c2cd17ff51e8
- SHA512 fda5071e15cf077d202b08db741bbfb3dbd815acc41deec7b7d44e055cac408e2f2de7233f8f9c5c618afd00ffc2fc4c6e8352cbdf18f9aab55d980dcb58a275
- SSDEEP 12288:IwPs012cBBBYiL9l/bFfpBBBBBBBBBBBBcA:jBBBYiLvzFfpBBBBBBBBBBBBcA
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1218586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/Quasar.exe.config
- SHA256 b44739eeff82db2b575a45b668893e2fe8fdd24a709cbf0554732fd3520b2190
- MD5 c8cd50e8472b71736e6543f5176a0c12
- SHA1 0bd6549820de5a07ac034777b3de60021121405e
- SHA512 6e8f77fcca5968788cc9f73c9543ce9ab7b416372bc681093aa8a3aad43af1f06c56fcbc296c7897a3654b86a6f9d0e8b0fe036677cf290957924377bc177d9f
- MD5 SHA1 SHA512
Quasar v1.4.1/Vestris.ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/client.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
- MD5 f4d16cfe4cad388255e43f258329f805
- SHA1 fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
- SHA512 867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
- SSDEEP 49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3294222
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
3.1MB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Quasar v1.4.1/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ca6608346291ec82ee4acf8017c90e72db2ee7598015f695120c328d25319ec6
- MD5 abc82ae4f579a0bbfa2a93db1486eb38
- SHA1 faa645b92e3de7037c23e99dd2101ef3da5756e5
- SHA512 e06ee564fdd3fe2e26b0dec744a969a94e4b63a2e37692a7dcc244cb7949b584d895e9d3766ea52c9fe72b7a31dacf4551f86ea0d7c987b80903ff43be9faed3
- SSDEEP 3072:yRAISQ1tRSVB3zpKTEPn6Rc0qus/6GMzzeSXLifsE2s58IB7aoqng5YnDBzs39AH:yRFD1niy6n6KwhO5mIYpnNzgGD0u
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
294506
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
280KB
Virtual Size
279KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ