quasar | 8ae0f170187701c391a7ef44d957dde423be508bff66e13ad7e375153230011a

Resubmissions

04/04/2024, 09:25

240404-ldwhgabh68

04/04/2024, 09:17

240404-k83plabg6310

04/04/2024, 09:09

240404-k4weqaba8z10

Sharing

Copy URL Twitter E-mail

General

Target
SeroXenPTO.rar
Size 49.5MB
Sample240404-k83plabg63
SHA256 8ae0f170187701c391a7ef44d957dde423be508bff66e13ad7e375153230011a
MD5 540f399062f2e223ff671c7d80eb2474
SHA1 a2027ca68b1703e03a836d8e563b4770d29c5391
SHA512 c47555a5501eb029d390711fec1cb747378e1cfd7d0f968e574295805ac2de58e509cf79ff3da8ddbe94e94e4304e6b39b28acb2a179ef6222c41bed62c894c2
SSDEEP 1572864:uMVF3K/MX3oMWm5c/NrsDL2ZVbdo/Wk+jgIg:132pm5O1ILqc/Wnng
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  SeroXenPTO/BouncyCastle.Crypto.dll
- Size 2.7MB
- SHA256 e1b52566d7aa215ee5583d5a5d2cfbc6cfdcd881c47c7785318552bcb41b7cff
- MD5 0b2aa376251567dbdc15b3a2a0d10c65
- SHA1 7e88ad9b36d47ec158d38f97e25f1a2a2fce014e
- SHA512 4cd784ea4fa8c51e5d9c9591b06b7b383a9713ed95a6037ff783838116dc0e24674b8e2f3a908b1e8e1dc18869e9ac5deb03ccabe3d17f18ffb13db695ce609c
- SSDEEP 49152:UEVmH5OGnsDVHKL54fKXyrJZd6HIksfqjQN/kIUcXYQ3:EH5OGIOsKXjQ3Uc73
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  SeroXenPTO/C5VM.dll
- Size 1.1MB
- SHA256 de6f08708b8bc6562828c7787769d14752b2c1ab0b0e9b34b1ed44987bd2f842
- MD5 37691c7533a9327f520ebe21faa72191
- SHA1 328ba7fe8627883bc3e31b7bf1cd317b442a4c08
- SHA512 b6334eba7103a986d4e2c12b38f34d084ce8d6b986ccb9775ec5d623b988546ce97308ddeb0239a5ec25e9d5782a27c777af7f89e757fdd35047723c4a0afdb4
- SSDEEP 24576:sR4E2L2p0QUSOuf4bB8BSpCcpsB7cVGKjCMF4X0eHKfuJVPwgiRkj97EJXn8t7k8:YTV/
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  SeroXenPTO/Cake.Core.dll
- Size 111KB
- SHA256 25fcb11500bffc21f1ae6cf3f5c4ff2e9450f41f01b6b02bcb5873f6f9b279f0
- MD5 c547895e4f6a86bf9db103260d5ce792
- SHA1 88491d4d711ccf09f50abbe8799afd27cbef5851
- SHA512 29cc3a8ea9986aabd3995fa403b919f6623226a5604ac5e073c5ef90c8c3a75845b098610e472e9e0d1bf2cc197092afc6710f1a17cc8aabc34fa71fa617c41c
- SSDEEP 1536:mSopfJvJPMCPGDFeCnyz1QECafmgOJu5a/p4D6mVENcdt6:mHJP5uDF5nEtVegOA5a/p4Z6
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  SeroXenPTO/Cake.Powershell.dll
- Size 24KB
- SHA256 d3494c0a006915c348d57cce502a0e56d01d6dc1631907604e95e7c323d54112
- MD5 271c0ad2a4f25c06d437254ad2d91d68
- SHA1 dc347e8af6bdf8aaa2017070166e38c73660d195
- SHA512 92e3cb01d285a93930dec1b76f9184352ba849b413b2568655f2e4a67cd480d2388caaf6b6d8dbbd7e705a693edd850d105c57b39534a352d58036b7323966f8
- SSDEEP 384:pR/zbDSq5s/W44uhQrl0qntPMN4GqTPmydIOnDg4ulTGvd:H/zbDSx/Uui5p04fPmEnD1uad
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  SeroXenPTO/Gma.System.MouseKeyHook.dll
- Size 57KB
- SHA256 a62784297ff461a71e549dd75d0437d37b1cf8d2b88305c6c028ced7555213f7
- MD5 0bf4660c28d0ddf365934c1333c62c2d
- SHA1 cf6313bf4f36a00f37b546f7cc5afd93a16bd821
- SHA512 2fd46027bb551aab5fc80185d38b391d53eb34e553fe648b908301ef95a8733043f6d3efc80e547fb25adb02bead39b4c73cd9bc4643190dd128b4d36048ce0b
- SSDEEP 768:vYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8Gr:AncoU48/AzPwYpNZ6rXJ8Gr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar evasion spyware themida trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral10 behavioral9
- Target
  SeroXenPTO/Logic.NET.dll
- Size 472KB
- SHA256 adc96b974ab1520ea0a18b7223f2e0084a52fedc4841f4074c738007fcf3b39d
- MD5 f7c48e31a7b79a58cdd0a41b6d57147d
- SHA1 6cc9ffdd9f5e70330eb12f0aea8bf890b85a2e88
- SHA512 d038abb5220a19b588bc1ad76ee10b2bd20fbfd357a5f8ae6d150a6c419648b518865f96f420c000618ec25ebccd143b0cfc91fde4d754ca6d1b10a6a27985ec
- SSDEEP 12288:RvVCoVD990usfOlCdXXJy1sw5D99GJuY9HArdoZqqiZm:R8oKdpyuw5D9wJWojgm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  SeroXenPTO/Microsoft.VisualStudio.CodeCoverage.Shim.dll
- Size 7KB
- SHA256 1b0c98a0ef3ab84d4dac3459bcdde70928eecb02ef4d575d3f264ff054800529
- MD5 dfefa869d2f7675dcbe00beaae68e35b
- SHA1 376832c08f93aa72fa240c63debd044426a0519f
- SHA512 c102383f5ce1b92d4b30737e8636cdb0f835aacfb479094c286b7f7f31008064f9229a460aa1e3b03c70db40b0d3d1fc2f9ff0765cba7f4b26b7c13ec06dbae1
- SSDEEP 96:CQabibnD54HXPQGxvKAWQDdiDL1Il5SWPTgleSn6WPLYu8G7GX:CqjDofNxCV1I2W7e6WT0
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll
- Size 124KB
- SHA256 5bfc5abe8bfcf35e4562d4782e5babeb5708db2d8714fd2170212384d2652d9b
- MD5 c462573a9dd520cd2e03652ca0ec9396
- SHA1 f872d79e5027b87548d1e6e3cd66c1fe4f0efc88
- SHA512 3b021015e005fbbbcca15e3249833e53715c57d867e7f876c00a5d5943bac3c192a63b02daeefc082b7f16373eb6503da0f8ca5722a272ef6d77df39b9e23320
- SSDEEP 3072:19DFl7hiU7MK/C2ZZ6uw2HZRBUDIrmbu+c3B5HZttOPVY7PzaL2CKJ8Yo:9iUAK/CoNHZPULST3B5HZttOPVY77aac
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll
- Size 9KB
- SHA256 bd19ce084093cb05a4186115857fb9d474c40da992a29629333b4b4247a4dedd
- MD5 4539091fa699d00d9f55bd2281139dad
- SHA1 faccb1f6f70ea6fc19d5466b3ee53c660a313aa0
- SHA512 2bffc4db6f65a33aa925009a64eacc2e995faa82c8aac11edbba9e9b4ddb1de79af4d15e92af7644a62f6343b8170804341069ed791d892e20806499eb855682
- SSDEEP 192:uCwc44i5A4vBYfWcUeKD8xJ5zBy/TW0xk:xi5AIBIW+KDq8LW0a
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  SeroXenPTO/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll
- Size 99KB
- SHA256 ec9a93948560fd6f5e219e01850946ef94992e18a0309b27d8df5f3420b23ac2
- MD5 f838683824ebb1b333e7056b529e69d3
- SHA1 d268808d3eac421a69ef4bb5b38fd86e65fdbf4b
- SHA512 d4131748842e149be5a7e75a6b7f362ad572973477c74ca6b21ae276acac6359ac6f7c49d0c6fd770775a77b612ef15fa820ae87cdc285511048fa27271db3c0
- SSDEEP 1536:ftdZMxG+d5x8JcNBaVV7nOHzVbKihRauFHQgMNfaElrsff95gUdR16gKAh8W1J:f44cNBSpOHBKihRaEQAEqff9VdRf8AJ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll
- Size 25KB
- SHA256 772a5b4160b0f68043e1fcf08c05fe6e7db064cc3d8fb967baaca74b52f7685c
- MD5 4777abb42cb84efcb672f88ec9c822b9
- SHA1 1920baf31c6afd29dd58a570ab6cfde4a2b0e47b
- SHA512 e39596a6dd6643aa0c4b53d95589133aeafbe0826610c08259407a24620c523d4055ced35c8fac67cd21b8aeea6d19465aaca9d76c3dadca0d2edf228094c5c0
- SSDEEP 384:grDjuKfEO77j7K+Hw63UZg+fzlgl8hb4bb/6bQfEKAM29cSaKjmST2ozngxYaWH/:EfuKfVzsgFCQxA5/mWng2O2
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  SeroXenPTO/Microsoft.VisualStudio.TestPlatform.TestFramework.dll
- Size 58KB
- SHA256 2c527e9a559da4ffec4c78e535b51d87a73703266428a6464c7fa79cbe706238
- MD5 324815abb2445918ef92d6b9ef33cb9f
- SHA1 f2c566e4013e97ee86238b4d8c3f1c05134cabd7
- SHA512 ddf842da018318baeefcc6c9e291dfaea79f970c1f5ece4b023092833b3ccf9a571c445787e2e45a1835ce8cb6edca120a7c6736521af7bce08b2b4ba2f1813e
- SSDEEP 768:kQK6GEpsh6tjavt/VhlPeMHi3klMdARhdhlD7pxva6K8W2FXvhLmiqc0WvnZHXMT:JDGEpNyr/CMfTCpRivvDWN+gqHof0q3V
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  SeroXenPTO/Mono.Cecil.Mdb.dll
- Size 43KB
- SHA256 91d67e936fff5d3ac2749c9b13ceebbdea1b3bd4bc24c5cffe55ea9ab4f2eecd
- MD5 308bff23291c88669892a50e65652d76
- SHA1 951baafb6ae175722e3285f1908b174a83a77bf0
- SHA512 85183ee053984d7b94e727860da237f85b06042713841f467d433b4d74875be231e712dece0514bd473078a0b0bddb0803c7cf2c2d7345fa27fe541b3d41a4bd
- SSDEEP 768:sr5EYZep98C87KHeBUZwrEF7b+gxfM3AkMus4iWJq9F4CRIcZwMRTIzyAt9U2T:sr59g98C87KHeBUbwgKirbdwMRTzAt9R
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  SeroXenPTO/Mono.Cecil.Pdb.dll
- Size 88KB
- SHA256 7f14d1eb2f0fa845bf1ec4a388024a204ff5ed8ad067740fb0372ff8f0236055
- MD5 c218304c5a8186312a9360ae28092cf4
- SHA1 d6ce633f2d43e1a7efb223604db7763e2c651442
- SHA512 a190663d5854e2ca096a8abcb2475d4ba2005cd1d9417d876cf706d1000c474c63e26c2ce52b004e50b5af6744a3f99ef215e51c44c335f43a8e7fbffe172c7b
- SSDEEP 1536:qU2qJ+RazRt/Kc4oJiOxFR4NdJF0/RfhF46HAoYKHgPzpS6w7fa1C9rj:t2MRtrfrR+Pe/xAiAzpQ7y1C9rj
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  SeroXenPTO/Mono.Cecil.Rocks.dll
- Size 28KB
- SHA256 736e2df0e2365b3d25da3c76783506669b4055477a5b0b0736527985fe6a09d2
- MD5 e6195a1f9eb3b2859eded91946cc4e01
- SHA1 4eb50da3f54d8acc76e6a84ec5ce11d67418f2bd
- SHA512 e0f225f712cbb98dc2adb023ad162bee8a1a572fac5d8c8d1cebd8f2f5d49ee93c684d0393c0af447a68ac15f4cf51cb927af934fac9c682113a7236cd33070a
- SSDEEP 384:d0ve8JOuJTiC7n2NwxEXCnjB+RXcMeDz8PmR1ugLoaeuLMBG9UphJAprjEduFLHj:d+meiCyrXOwS8uRssveum1peFLHFBbOa
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  SeroXenPTO/Mono.Cecil.dll
- Size 338KB
- SHA256 2f7af51f2f4daddb812dc0662d1cbcca7709009a50402ab42e93853ce5a5231f
- MD5 6930ba212fe20aed8da228fc4c9ee3c0
- SHA1 bfedc88f33504349c15bbe02a75794a40978af4f
- SHA512 4f0f852c36a37762b83a4174f37503becb667924448609c2cbfd7596239d10b5e7ef53bb1214b4f7b4c5cde42d3b9d1a70758ea422c4983b3348ba61e61f1b99
- SSDEEP 6144:ZFzzF5VOCxfiKKhsw4NiL0XRzx9WoCklyusA:TdfiKI4RzWSyuR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Quasar RAT

Quasar payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Loads dropped DLL

Themida packer

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32