Overview
overview
10Static
static
10Quasar v1....e.html
windows11-21h2-x64
3Quasar v1....to.dll
windows11-21h2-x64
1Quasar v1....ok.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....db.dll
windows11-21h2-x64
1Quasar v1....ks.dll
windows11-21h2-x64
1Quasar v1....il.dll
windows11-21h2-x64
1Quasar v1....at.dll
windows11-21h2-x64
1Quasar v1....on.dll
windows11-21h2-x64
1Quasar v1....ar.exe
windows11-21h2-x64
10Quasar v1....ib.dll
windows11-21h2-x64
1Quasar v1....nt.exe
windows11-21h2-x64
10Quasar v1....et.dll
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-12-2024 15:17
Behavioral task
behavioral1
Sample
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Quasar v1.4.1/BouncyCastle.Crypto.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Quasar v1.4.1/Gma.System.MouseKeyHook.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Quasar v1.4.1/Mono.Cecil.Mdb.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Quasar v1.4.1/Mono.Cecil.Pdb.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Quasar v1.4.1/Mono.Cecil.Rocks.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
Quasar v1.4.1/Mono.Cecil.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
Quasar v1.4.1/Open.Nat.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
Quasar v1.4.1/Quasar.Common.dll
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
Quasar v1.4.1/Quasar.exe
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
Quasar v1.4.1/Vestris.ResourceLib.dll
Resource
win11-20241023-en
Behavioral task
behavioral12
Sample
Quasar v1.4.1/client.exe
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
Quasar v1.4.1/protobuf-net.dll
Resource
win11-20241007-en
General
-
Target
Quasar v1.4.1/client.exe
-
Size
3.1MB
-
MD5
f4d16cfe4cad388255e43f258329f805
-
SHA1
fe7cc6c9eb76b5ad97867b46d053fae601fd4a2d
-
SHA256
8fb6ae3496d4ac025eab443d3e322b0faa3461d25b54093c9205d35746e3250e
-
SHA512
867045eac0f7765e6bea51e62bc4ed68b1e81ce6c2843d2e08714eb391a8ac94c2571c09828286252248400ea5c12bffa50a25c8ec5ad9e6d0bb836320ec188f
-
SSDEEP
49152:4nb7+y2FqZaVmN+PqlhU/mevlL1nYtsCeAcxUuxG2THHB72eh2NT:4nf+y2FqZaVmN+PqlhU//vlL1Yts3Bx
Malware Config
Extracted
quasar
-
reconnect_delay
5000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral12/memory/1452-1-0x00000000004B0000-0x00000000007DA000-memory.dmp family_quasar -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1452 client.exe