quasar | 4fd29e393c3b38ec8a90ff126bc692ead3a4b56e1269fc0d242a8cbbf25fa7fd | Triage

Sharing

General

Target

Quasar-master.zip
Size

1.4MB
Sample

250131-la26vatnem
MD5

10e9e98b1e34511ed934908890a5a6e5
SHA1

0b82ffca06d2b9e4c20747eb14497b76bd5ea939
SHA256

4fd29e393c3b38ec8a90ff126bc692ead3a4b56e1269fc0d242a8cbbf25fa7fd
SHA512

70d4e11719eb39f949022f6740c8ef9862ac47769cec3f077856dc66179094b3d5d5922a471b2427251551f5e61cafe6c3548f3ebcff65765077c4c9b4147883
SSDEEP

24576:N7xyUKwYWRsYPa0f4sVMy49jwXtr3FLqNN6R9Df3F6zDcKin3FRn23Fwf3FMFsyC:N7MRwxRXTnVMy4FwXtrVKN6vV6zfinVV

Score

10^/10

quasar execution

Malware Config

Targets

- Target
  
  Quasar-master/Quasar.Common/Extensions/SocketExtensions.cs
- Size
  
  2KB
- MD5
  
  de7743bb0df3059b850075c3c468ae7a
- SHA1
  
  06d86e450bb3fb5687afe181ffade91223693408
- SHA256
  
  42a90a06c03775e5f5858b09e76598d76b3a7f6f26a58b20ba2f5b1c33d19162
- SHA512
  
  40a536b02620de784b9fd23639371b626c9e52aac25f0ba6f84db91fa397fb829a7297148f94d053f67cf04ce9120e4f66cba4a773e5cee6a81b5de65924def0
Score

3^/10

execution
behavioral1 behavioral2
- Target
  
  Quasar-master/Quasar.Common/IO/FileSplit.cs
- Size
  
  4KB
- MD5
  
  412f7972c229ad02620584a8cf4b9604
- SHA1
  
  55366064bd74f6c8be0911af062a1e3487eb7d84
- SHA256
  
  c3375c95ddcc65791701f51dec221273b82dcb23a67c97a76d135ebd52fcc378
- SHA512
  
  59ef142276a0a0b41f45e8716a6eddf1b36206e379f4d988df76ae8b137ab252d86326c80b308aeef74a7eead347a68fa048d33b37c45b32a1f282aa57d0b11f
- SSDEEP
  
  48:2j4d4Y10psX8ZgLGhVQ4XCfO/EzManjufa8ZDvl3Dj9KXuF9T7O9q5Vu7mtmdn9O:2j4d4Y1oGUQgg7M9a895TAvWjL
Score

3^/10

execution
behavioral3 behavioral4
- Target
  
  Quasar-master/Quasar.Common/Video/Codecs/UnsafeStreamCodec.cs
- Size
  
  13KB
- MD5
  
  f6f684886d32fa76b92a8878c277f2c9
- SHA1
  
  ec22305cb7fa862a94feec0eda0d2fcd3281da5d
- SHA256
  
  8f9c56ec4fd84ababe9836290eea85e8ccb39c0e0ac3929c39b1279a709bc2f4
- SHA512
  
  5fc43e219dd343fa01af7039a93381ff4b6bd529ae4aed9f581f36cae6099fb986d37b24304da9135ee18055d164f29d3fb3575679bf7bda3027127a6f78e6c5
- SSDEEP
  
  384:e2rfFMJVNh984CrEIYW5xjhVdA0PYuhuh3hRkyhOtzeh+:d0CrEg5xjhV6eEZfkyQVek
Score

3^/10

execution
behavioral5 behavioral6
- Target
  
  Quasar-master/Quasar.Server/Build/ClientBuilder.cs
- Size
  
  11KB
- MD5
  
  a262eaa5a766314c84832ee841204827
- SHA1
  
  966eae0ec096167ab0422230d1bb15a8f0d56263
- SHA256
  
  9d5567e14206cc2007b90fdae540d414b43167922515eef78f9e5986fada4431
- SHA512
  
  cbacb114b9f2203123969ddaaa6a0f0205ab191b59a0efa35651f137b626ac23d883a3e38be9ec99c1964e2599458378bf34a66f9037917e280cd056e449645b
- SSDEEP
  
  192:NqtxF/uHSPkEAbX/JKZAWwDlTwRqAnlGuhCyiSC4/kbyL:gxNmSWPJfrDlkqg/k6
Score

3^/10

execution
behavioral7 behavioral8
- Target
  
  Quasar-master/Quasar.Server/Controls/DotNetBarTabControl.cs
- Size
  
  6KB
- MD5
  
  56a7e0f52c3ffdb0414d48c07c2b3c64
- SHA1
  
  5c893e34e95b3b56c892837ab19f56b7e7cb2b07
- SHA256
  
  2b446fb2a58bf87b8182824ac1c4eac20a329fd8762b4f9baa6371dafd3f6695
- SHA512
  
  36981db4611cec9ba842451cc45e7ba73ce5ec36d251baa746ec3291885b758f46f21919b5f1d96961f83efeab12ce7cabb1143b03d5c2e932ac5a62eaa35c8e
- SSDEEP
  
  192:Vr6r/SBYv23Lwcz54sKHciab3sAxqsVsyVsiaJFMSeb:Vr6DSBYv23Lwcz5sYcAd
Score

3^/10

execution
behavioral10 behavioral9
- Target
  
  Quasar-master/Quasar.Server/Controls/HexEditor/HexEditor.cs
- Size
  
  37KB
- MD5
  
  4c28b4e58be096fe90a882b84b6926c7
- SHA1
  
  7c8c2a7837e15a60c4ee0e220e28c3387ecd8fe0
- SHA256
  
  7ec499b5d6e677199020b5dca37a02f53fb8617aa904865cb51389c452d0eb78
- SHA512
  
  0bd0e59fae2650eea457e9d75ca512e09e1258ca4e51f2ba3967ac10da20c9decd9f0e7b814ed96c56f5a82600c2db5372dda6250e0b9b91647e21dab50b240c
- SSDEEP
  
  768:EOBGLQdOfvyjiYTF3/77UT8qFhjARhyd0PwcxFsHBa4r:5BFZqFhKsHBa4r
Score

1^/10
behavioral11 behavioral12
- Target
  
  Quasar-master/Quasar.Server/Controls/WordTextBox.cs
- Size
  
  4KB
- MD5
  
  9567a0d241011df83b09ecb0a84723b6
- SHA1
  
  375a019cf38d801dde58915d143b718011337121
- SHA256
  
  32c6f13f20d5faa2ab8fae5afbd07b5c9dd61646d1b866a5b4bc8b00fa121ffd
- SHA512
  
  bb6b3911800d9ce86b15e06825c3663fba9f270e0393d1143e4ac5a6fdc9b2417a641d036df5c7454e1a2a5c7b0013dc93a31e8d0e80f53377e50c321ba39b59
- SSDEEP
  
  96:JjegQn35aH7SqsgHSgMcHpHSTnfC7868CeffFNaO66JttA1YyL:+n35abSqsgygMcJyTnfC7868CeffFNar
Score

3^/10

execution
behavioral13 behavioral14
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmAbout.resx
- Size
  
  52KB
- MD5
  
  5fd0d5f439da8b408d48bcf2f1cb2ba3
- SHA1
  
  d27467190a6cbb99b4802a3ed429a2118b69abb7
- SHA256
  
  d13a40f106d9e65d8a910015bf767f05ba59cc99e249dc1a301b882114bc1730
- SHA512
  
  e6e555662b5b6dcf4447bdf6daba0a4091641a6bb45942b33ef8f5014d9289a4cae837089a0451a4d11d213e7212963a2183f288b3566f62b32664e15c976a29
- SSDEEP
  
  768:ZfWMnXOiW4myXqa6Y7PfaU5JLyFWlGsenXC+:ZfIiW4myX9DPZNGWxKh
Score

1^/10
behavioral15 behavioral16
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmBuilder.cs
- Size
  
  18KB
- MD5
  
  e1ee9dc68980ce59316e75425b869f69
- SHA1
  
  b0a07cc2a71950816b847f68974aeafe66510dc2
- SHA256
  
  75ac5fb1d73da403714d55fc9e166d4b47ba35e5d74fb251f509bc448696f6f6
- SHA512
  
  3f3c812f6a8d872884f97ea9be28ce36ca99ccc1fd0ce1a3b8fa45ff53c38996c9ac9205e82d61bb48938399625d6edf5effc6d87e6243427525bea219621eb4
- SSDEEP
  
  384:ej0VDYFcbPZY6bGVoUS7QEUwDXtDh7xE6qMYoFj9lbX17i:NbPPbGVoV7U6XNhVhqIp7i
Score

3^/10

execution
behavioral17 behavioral18
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmBuilder.resx
- Size
  
  52KB
- MD5
  
  e27db99a83e6d09a72c53ddb138b7a1e
- SHA1
  
  5f007fa8ed1e920530f88dcc6054122f04af0bb4
- SHA256
  
  cf6accf3fa5ffc88fbc780d8b01f1687047dbabace7406f3b52323e6d3eb99fe
- SHA512
  
  8d3f8112bd353c3499edf7f7a3bf64e3e94d7d0a58550dc0208b81f82b5e7477935ebfe6d086f4f46808950a8ea7b6e4d0e96b162bd1e133e4427628db70be49
- SSDEEP
  
  768:ZfWMnXOiWVmyXqa6Y7PfaU5JLyFWlGsenXC+:ZfIiWVmyX9DPZNGWxKh
Score

1^/10
behavioral19 behavioral20
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmCertificate.cs
- Size
  
  3KB
- MD5
  
  c7509fb9cef5ee7e50b9769f35297099
- SHA1
  
  ad1758855fd2b2068ea3196777afeee44352e80a
- SHA256
  
  e04ed322b32e8637e45f3e28397853e4b5152e6e4202c91b6f501ceeb4837c45
- SHA512
  
  45b5fa2e93b25d323746fcd44e441caa5148fc013790b97fc8e39c17832414ea95a853b1af3c129b17e24780fffc81d2cd65b91206b38253960555fd6593e994
Score

3^/10

execution
behavioral21 behavioral22
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmCertificate.resx
- Size
  
  52KB
- MD5
  
  5fd0d5f439da8b408d48bcf2f1cb2ba3
- SHA1
  
  d27467190a6cbb99b4802a3ed429a2118b69abb7
- SHA256
  
  d13a40f106d9e65d8a910015bf767f05ba59cc99e249dc1a301b882114bc1730
- SHA512
  
  e6e555662b5b6dcf4447bdf6daba0a4091641a6bb45942b33ef8f5014d9289a4cae837089a0451a4d11d213e7212963a2183f288b3566f62b32664e15c976a29
- SSDEEP
  
  768:ZfWMnXOiW4myXqa6Y7PfaU5JLyFWlGsenXC+:ZfIiW4myX9DPZNGWxKh
Score

1^/10
behavioral23 behavioral24
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmConnections.resx
- Size
  
  52KB
- MD5
  
  a7bcdb6bc05b67560cfcf14839f511b0
- SHA1
  
  6a052fcc22aa55546d9eab2f196c4d2627d0854a
- SHA256
  
  399c4d943e414b57c9d5b717a768f1cae054eae4bcc12afa80acaca99428c630
- SHA512
  
  b5033fbcc3ae0a035fc96e31f46cb7c6319cfcb4aa50ad9586b6d7f8e456e0484ba5d9ae74d1f943342e6de1a0f14330f74c5a41c59bda854cc6b0796f07dee3
- SSDEEP
  
  768:ZfWMnXOiWemyXqa6Y7PfaU5JLyFWlGsenXC+:ZfIiWemyX9DPZNGWxKh
Score

1^/10
behavioral25 behavioral26
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmFileManager.cs
- Size
  
  20KB
- MD5
  
  fb02ad50c6e2bbc340cd42b649ab97f2
- SHA1
  
  83a9c4014e175d301735d8daff582284056f6761
- SHA256
  
  9e927633ed287ef5cd1fc3fee20fcd236bb3f4ea511800710228ea6ee9c7982a
- SHA512
  
  cd9070e268ff95dc50e62b8cf9e2810caf3ade8eb53e60d28cd857bac79b36a8bd80841aa15ab4dba22c0b7a772193a385bb2ea9ba200a364b724377e8e013e2
- SSDEEP
  
  192:aYqhunLqUZdPvHZqRuPNg5s5aCr5DARqNapzgALi7yXakgtDsKl7j5qCnZ6ZbbM9:aKn69R2s6FzsftYLypF98
Score

3^/10

execution
behavioral27 behavioral28
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmFileManager.resx
- Size
  
  67KB
- MD5
  
  065455ffa43b892567547b051d308d65
- SHA1
  
  dffda448384daa3f25504d94bf4c532850bc783b
- SHA256
  
  6efc56774c640dfe8edd2356ff22e50ef16940d2b0322c752a63c4abcabca224
- SHA512
  
  1f3ad0ae3085c230afdeb895dcf10996468d2a78cd685ec76c6572965402f59f08ba2d335cf5ad5a836b90dfb1d24219b6ce597b2ed812341796ad1003a9a594
- SSDEEP
  
  1536:ZfIiWV2TZyrhESgq6z5vy9ogmyX9DPZNGWxKh:ZfIN6yrl16z5vyIypnuh
Score

1^/10
behavioral29 behavioral30
- Target
  
  Quasar-master/Quasar.Server/Forms/FrmKeylogger.resx
- Size
  
  52KB
- MD5
  
  a50117cb135e42f2771459b05a21dd88
- SHA1
  
  1b96f067d6136d2006c5a37068a1e05a7ba90add
- SHA256
  
  c4007784853395d74a59ff7ffa797ef66a4d6b9da1f8be12ab99e4372d5a28b5
- SHA512
  
  2fc63a41a83910ecd2e6c698a563935daba36f28b622d4be14ec234b01a3084a443e16abb1f05674e3acf523a7cd8ac91983cd4258172749e542207e45cdf9a4
- SSDEEP
  
  768:ZfWMnXOiWsmyXqa6Y7PfaU5JLyFWlGsenXC+:ZfIiWsmyX9DPZNGWxKh
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32