quasar | 51a8255b49900d66ec1640d09f12c057b8d0a2e0dbc6e8dee2f61b959a52b2a0

Target
Seroxen.rar
Size 5.3MB
Sample241018-fe484syalg
SHA256 51a8255b49900d66ec1640d09f12c057b8d0a2e0dbc6e8dee2f61b959a52b2a0
MD5 286f0347a330df2518e5488f90bec5bf
SHA1 0617a0cefd6c790f7ae114dd1c79d201a0e86fbc
SHA512 a5f9ace81e189082426fe5741e2d0db0296f98498447d6aca2310e9d4f220df28c836d7ba794a98cc795fbd88a1581399f4e7d18dc2981de59a50fedbb770e78
SSDEEP 98304:r0SEKW29bLizS5Dg3Ib6ohMBNs2njUpdl0k1FQ4K/U7uTYwMYwfkDQ5EIIOn+0+w:vVZiaDg3Ib1iNsRz0t4FKVtDDmn+0N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

127.0.0.1:4782

Mutex

$Sxr-GV6wZsGZZMeZ3qfenc

Attributes

encryption_key
EUSviIV2seOGLpaj2p7j
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  Guna.UI2.dll
- Size 1.9MB
- SHA256 836e1cc306eab0817a10c613a9c99d4dcbd604624b8b90f551d410dc164eef82
- MD5 83e9df5d534f50280251d662861bf476
- SHA1 d2ecd37e462b3c6fa763341a12f9de74326cb646
- SHA512 af38cfbd5fb866662afa4548011ba2d262cd70ff145fe4118db3322a9ea243bd9d8dc9cdfc62a246df014949a94d159bcd47a8f8f04010b93c963511a7e6a72a
- SSDEEP 24576:+5lxrKZ9DHFoXP/Jt/A1IKKPZANZuwgHQ/jz41RMIK24:Av/CIRqwRMIK24
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  Mono.Cecil.dll
- Size 277KB
- SHA256 3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e
- MD5 8df4d6b5dc1629fcefcdc20210a88eac
- SHA1 16c661757ad90eb84228aa3487db11a2eac6fe64
- SHA512 874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174
- SSDEEP 6144:iYOMWAEq+PAEwGQ9Xivs0s4EtS1Fv8jnLKdFvkPo2:AG+PpjQSHv8jA
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3 behavioral4
- Target
  Mono.Nat.dll
- Size 40KB
- SHA256 b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
- MD5 bf929442b12d4b5f9906b29834bf7db1
- SHA1 810a2b3c8e548d1df931538bc304cc1405f7a32b
- SHA512 9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
- SSDEEP 768:yoVesKx0V2LpibQJxoKUDHj560aSX3zlJAO:lVespQibC+H56k3fF
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Octokit.dll
- Size 1.3MB
- SHA256 41508af363730c9df614bfe3e498cf5dc4565ec54907f7fb26bd86194e5ff3de
- MD5 80feaeb7b8c493df5534c2b5c2c43bae
- SHA1 c73542b0a4247442c2aa979b7d4e7210ed87e03a
- SHA512 7e627e64e2273d6f0c054decd3e9cd6845d191f56e1ce29591a011e59b815805a26eba36c7746893567058fe21bde887a37c1aa89bcbae749ff00eec66d6a69b
- SSDEEP 24576:7PhshAfmAoEpwQQWhZ62KLp+CkAdjG3sMs2Cd5o775AxUzNZsPbKAayFHV+Sg:NrHCkAdjG3sMs2Cd5o775AxUzN8JayFr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar seroxen discovery spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8
- Target
  Seroxen launcher v3.1.2.exe
- Size 1.3MB
- SHA256 268067fee4b2cab61138bcaa62402c1aeb68d6db3c92f23be88b6c61071a0ec7
- MD5 a30b4df046ff1aeaa9bc6aeb650dd9aa
- SHA1 538b3248c00d43b6371d88151d43b4e95012da5f
- SHA512 91c175b4543eba084b32f79b3f4fdb144c47d78eecf7955a4eab0409c03bdf7d275aa25f13aa592fc7d307af1d351746793bb632d7621597273bae294d06ee73
- SSDEEP 24576:N7njFX9ew/1bffPrhEqE0r+UPffBhffffffffffjhKhrfQjsRw:tFNb/lffPrhEqtr+UPffBhfffffffff9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Siticone.Desktop.UI.dll
- Size 4.0MB
- SHA256 21eecaf504b7fe787a45f4aa8f8f36dacfc3ab1d75624dfb41827cdef2a9a589
- MD5 1582aa45d981e0e569c6e05698642b30
- SHA1 763506f312a186c55a04ef6a16ad7e867c394097
- SHA512 278a7a4e2b9d82528200b9f92244db3f228187d15c36fd169deb927e343bc4d0bb29c9dba496f86558aea4f4deb44d1e47a41d5598c0b375d99ad9fbe99cec34
- SSDEEP 24576:UCCxPAT4L7h3M7O2MLBSlvTh/aOBteUePU/DU/GHQYazK/DkWoql3zjbndHQ/jzb:WuO2MIThZNwewYDoyG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  Unity.Burst.Unsafe.dll
- Size 5KB
- SHA256 9d9c1ff52411decbee5d9f0d1cd61ebeaa222077aa77a52101ea3debafae98e2
- MD5 129351e9879a83262ea92a4a45aacc46
- SHA1 3b34cbb3f76a73e2f14571c105202dc5f147d83b
- SHA512 d1dd65654d4e12dabb148b9bcde6b99bc7314b453a25b80b07c5d81af322b23a9d064b88e64de202de0b56c0b6c72c8fd7fd8931b63346e7886ac8ba5e247465
- SSDEEP 48:6yz9Yuj7TafnR3qCEfjnl10NuBi177UULkhzArxoMjzbALLT5SXBiZFmqqn8M3lg:zbad7NLkG/qygZFSzZBcMdugSDJD9
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  Unity.Burst.dll
- Size 309KB
- SHA256 77b3d9c9f0f60c02af89276b473909585df27e3646fa28236eb99332a9f1ab51
- MD5 999e54df37cdf3e01d4ea9f997a624f5
- SHA1 cc2578a964a85f81ef730e465aa8b1726ae64d35
- SHA512 fece2f5df55ea0e58dacf8242fc03ab937faa3ecbacbc260787e86d459dc6fcba9df5e271f2fb949786d13b057e6cc2e3c28a18af55459bf9975d4f3b6b3eceb
- SSDEEP 3072:QK3NiyhxtfMxHoktRxKQdsUxeOXWHuMSOOBwgdKGJAlYygx8MuKxTSwyhZhKKcDk:9xtExIkiS1ADCDVTSwyhZhKKcDV+dmr
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  Unity.Mathematics.dll
- Size 734KB
- SHA256 4f623e77dd97b8bf4c18ffc46ff9da9c1770868ffbe2a87cc5bb98551860f40c
- MD5 117fd091d3e32b195753108e9edd905f
- SHA1 eb1e0abc8b49ec2ac1d1f2c71b27a389148d8f7b
- SHA512 36764d248ad869dbd674e9865b617d5601cec9cb961d13a2fcdd51078f15ea23eb3992f37dee5e7b3e5bbeee048a0342bf476038d996295b53d85a4363555054
- SSDEEP 6144:IVQAtxMbzkvIV5iHzqQsE2gVMVMrGaOwuSCvt69wupiaquxhDlQphFz/GknU7LqH:xdbAWiHzqQsE2eUSsMwupBXQpX
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17 behavioral18
- Target
  Unity.ProBuilder.KdTree.dll
- Size 20KB
- SHA256 485b283937a2815dec8e0161e0aabf1904cbb681c43168e1007ce713bdeb704d
- MD5 f3413d6df6697025a1e35a45ec6cb47c
- SHA1 c406cc82632ed2747a3e96611fdfc843dfb7376f
- SHA512 fdd9fb11c2370def330a4042768c44bb202367c5acf8b9d12a17f89c1d8f316b3eaed5fb9eec1acf7bdec010ede607182e2ba76eab3a380b72cdec19eadb99bd
- SSDEEP 384:M48H1u2nebvVT2MmQk2QnY2V88t3wMHNfQoqjotyPCEvGTqIgL:M48H1u2kT2MY3fqPCHTqP
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  Unity.ProBuilder.Poly2Tri.dll
- Size 39KB
- SHA256 687234b94af6e65047e6f32d2edf420ad5f33f59fbdf63f5d1573111f5c4bf3c
- MD5 6dffbaba49027e2aaae482237027484f
- SHA1 995cfb51b1c24266f89ad34ae320d82aae036798
- SHA512 e324272fc247e3a6061890893b182466e56b1d0f806e74c7293f25d86a7d89133e3e07658c8da6bd790f7745d342cf7468dc21c20a42bba0c86367b5fe9d5c9b
- SSDEEP 768:9mugwqJvVXLkMJjr2vrH6PO1IhfeeOxkHw28XAvN:XwJvdLNJjr2jbded8XAvN
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral21 behavioral22
- Target
  Unity.ProBuilder.dll
- Size 393KB
- SHA256 7dbd3912fcebd49a836a3b0289c8b0d8d23d1422ece012fa5ab81441425675be
- MD5 cb10bb038e7ae561fcb62326cc098c82
- SHA1 d7ba80e3ce44bf14a30c6f1c93f60032d8f0d3c8
- SHA512 8531f19a01ab7c3d4eb1c0d977065eab5db89280b737f868c3f4a00ee87e011fe3b6c09d28ac3b8fa6fed2038202feb7016a6848b4e34aeee0616a279b56f507
- SSDEEP 6144:qA282VgNWIByFdgzXUdfXWWdEl3BrXRaeHC68j:t2VgNOFd+kdfXWXlzW
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24
- Target
  UnityEngine.AIModule.dll
- Size 56KB
- SHA256 b8824a33a59c6688b8699936f7766ae204d7c36a5f9c5e9f3e4d265ff5615fa7
- MD5 c20b271bd00f5b10b91bd69cfbe734dd
- SHA1 2bbf3b546cf5d437fd6662640c4bc7270d2dd377
- SHA512 ad4102ff3f9dc31b325c10b5e58bda86910c4da254eea5e8a63695d51eb7f641bcd0f9f1e69826e943ffd1e30d6f373703082913a2aecfdd0c71b69a0563aa85
- SSDEEP 1536:mKJXAjbkEPznZMb+WmzncHAhjMFSZhvj7TPx3kXa:mywPSaWmznfjfx6a
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  UnityEngine.ARModule.dll
- Size 20KB
- SHA256 2f7bc3f1d062b0a645757a4c9e65dd4d055cdf3ca3923039a847d63a78466d95
- MD5 01fdcf1b2c75180101b686eff44d6d77
- SHA1 073ddb5ad7caac07b8e19ad523e65d838aa58611
- SHA512 390cde936fffddc0f339a1dc8b646011a56eb336ea82ef8ff98d52a05328379353fd92475be6a10127bbeb646aa8d99278a3cfd1468fda2c816e5794c5b2fe30
- SSDEEP 384:LyBsd4+azncH5z2hjMFSZcjOVVNyb8E9VF6IYiTPx3nk1AXu4ZY:Lyc4+azncHAhjMFSZhVxEpYiTPx3kb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  UnityEngine.AccessibilityModule.dll
- Size 23KB
- SHA256 f23b48f5c5423cedda10fce0e4ad666b8b6484cbde846ad31aa6af9d8bd28307
- MD5 efc7c40c3b5a989498a58576646706ec
- SHA1 064dc9cabec4cf37aa90214eb0f6b8f6ad9ee1c0
- SHA512 cbb269c509f002ff2865119b962844b4427c580347df23c53e185a5b184e65f1b1e61f4cc2bec5234afca40cdf815dab5a6e36b0f3d717619a084f369a6a3081
- SSDEEP 384:Gx8QRNUDVhP660HyaCKzncH5z2hjMFSZcjOBxNyb8E9VF6IYiTPx3nkZBwb:Gx88CRlb0HyatzncHAhjMFSZhBVEpYiR
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  UnityEngine.AndroidJNIModule.dll
- Size 90KB
- SHA256 50036b581888ec5124e8e79282413b55f9d11b8eb8ee791f9f7b4c8c1d1c9d02
- MD5 6dfc871996746831cd57c78e73600e6a
- SHA1 0a14c3372432e70b500993145bebebdb5f51123d
- SHA512 7a4d08bb60bd5e203b9ab3ca6b7a3ab097a9563149f5c526f0ac0dd79ffc9228d8b6fd6c37be2d4d85b2100d20c3d658f39527db70a3ee3a93dacb88667ddb6d
- SSDEEP 1536:MMfO8AaTr+lldcCxhb+4hw5+imzWgzQcuozncHAhjMFSZhD27TPx3k4:MMfO6rolddxhb+4h09mzWgzQcLznT2fV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Quasar RAT

Quasar payload

Executes dropped EXE

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32