quasar | 05a360c1e2642545781594dd23b04abe5cf69eef914e057de51eb67d9f42b7aa

Sharing

Copy URL Twitter E-mail

General

Target
BlueOne Rat v1.0.1.rar
Size 6.1MB
Sample260701-tdf2sabv8v
SHA256 05a360c1e2642545781594dd23b04abe5cf69eef914e057de51eb67d9f42b7aa
MD5 8607ac6a2df4ccd9b7008758861ccd92
SHA1 e838d314516f95856fdde26396981afb2604b2de
SHA512 0c61252370af81cbde6b39fcebb25485172b26176f4b6b947a64f0ce2b164e291ac2117761dadd3ed186958753ec999c61bf37151ce1a02422ac8d74e5ded1f9
SSDEEP 196608:ziAanfpVeqgrkpMbmQinYgvGEUpSlMb6hG:iVPokpqmrnZy7
TLSH
T13F5633BC89D5D23E1D03854B0E9962F44B6339378BC6384232E3D235AD2B56DE95923F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.0.0

Botnet

Office04

127.0.0.1:4444

Mutex

5dd8969d-a2e1-4633-805b-13a56e4c3f2d

Attributes

encryption_key
2ECA15518F01457176B8237A59860796FF575453
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
BlueOne Client Startup
subdirectory
SubDir

Extracted

Family

quasar

Attributes

key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
reconnect_delay
5000

Targets

- Target
  BlueOne Rat v1.0.1.rar
- Size 6.1MB
- SHA256 05a360c1e2642545781594dd23b04abe5cf69eef914e057de51eb67d9f42b7aa
- MD5 8607ac6a2df4ccd9b7008758861ccd92
- SHA1 e838d314516f95856fdde26396981afb2604b2de
- SHA512 0c61252370af81cbde6b39fcebb25485172b26176f4b6b947a64f0ce2b164e291ac2117761dadd3ed186958753ec999c61bf37151ce1a02422ac8d74e5ded1f9
- SSDEEP 196608:ziAanfpVeqgrkpMbmQinYgvGEUpSlMb6hG:iVPokpqmrnZy7
- TLSH
  T13F5633BC89D5D23E1D03854B0E9962F44B6339378BC6384232E3D235AD2B56DE95923F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  BlueOne Rat v1.0.1/BlueOne Rat v1.0.1_Unpacked.exe
- Size 2.4MB
- SHA256 fea64a68b4fa0f9aa8dc9ce2df751c834812df0c19fffbdd020143ec6855dcde
- MD5 d120839bdcce906583ca3b3a47de29d4
- SHA1 8508f764a6876aeda93537cd30c4600526028228
- SHA512 6e7b2d5bdd0867eb3ca7a59a0b0053ea976e272fdf3bb8f405c2aabca9c631b1c3a3787b58014af67210bd1395ec6bb1a66b8d5f0de9c6675afbad07cc5c6e29
- SSDEEP 24576:m5rKp5ccD+6cb3m/0A2ErM2phBQxzeC3dqd4HHbtHHCkdei5YIfkrIL3HRKHHHHt:m5042852zCzRod5crkUVRw3i
- TLSH
  T1EBB5C05233E8991AD07E63B2082145508BF2FD03CAE7DB1E093179B82DF6751EED469B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  BlueOne Rat v1.0.1/BlueOne.Common.Tests.dll
- Size 6KB
- SHA256 8a84fddfca1575ad1e9fbcc4aa989524c54f3c4f22f0df7d2a3893d533b73887
- MD5 66fa11e8e3dd9bf473f4d493378c0651
- SHA1 5a02f0bc66b82085237da105566f6add027a6e12
- SHA512 b3e38e0bb8a83582c1d9a57a460128c9e2575a5959349a142ca8dd626e3d46e3da4fd4fe3fbfed088f049f59dbf4d0bad381eaf52705e51257508bbf4edde7a7
- SSDEEP 96:+gBxmvnlyWPhi88vpAGD/pzLrCT/UfuhCd0diWYeLAWyCWTP:+Nlvc88BAMFCT/UWhCd0FdLAtC6
- TLSH
  T1EEC1C728F3E48332DFBA1630ED33A65582B9F710AA139B3F04C9A2062D9534844B1BB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  BlueOne Rat v1.0.1/BlueOne.Common.dll
- Size 65KB
- SHA256 2164b435c208229851083868b123347c933b66e609b5c13b66cb29134e77bd84
- MD5 191d1d72284741d032c27f69ea9723a8
- SHA1 29316e6e9b6a535feecdc05f3a679ed7db9d4ab4
- SHA512 d543ba4433e4df03fb1cf132fe34f21e69d902a970c661c0150ad054ad6a9f515d1f4825d3f383d1c944fbea3729033fbcd7f3e0556122e6e98b22e1f8a66289
- SSDEEP 768:XiF6Vg9HIxFMu9brfp0kUEb9k/pUHRfp0YDpb4rILMgYY44YYXINk6I+Q4D9+wi2:T9tYLMKOTOUHaPmU7xJGA
- TLSH
  T15663D621AF6983AEC75D0638F470922943B9D20A3107DBFF8B54B96B7D27F8151019FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  BlueOne Rat v1.0.1/BlueOne.p12
- Size 4KB
- SHA256 fadff746b6ea7f47a5690c40b96c674727d32f7bd46f98606428d8439b7e485d
- MD5 cd3c2ed6e136f97585e605366ec10b96
- SHA1 ec1a0694a6805a5d4b01b3d36e6ae013b5c31d8a
- SHA512 7da621c48d48ce16e8d978ec3d5d7ca9c22f3c3139f7623eb9a163ab4e6b0078468e118410c4dd163919fab32c8cea8a5d329abbf6e5f28725c162ad7b399333
- SSDEEP 96:X/Ds+aXeJVdXOUCH9mvxxq8OuPS6v1rV6Hg7Mx/Jae5i:X/0XeJW9MxxhLdR6X/Zi
- TLSH
  T1B3915C063E5E2B699E6E88285BAC1349D880F6E97E3CB11E2F2125501DB0FA15C89927
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  BlueOne Rat v1.0.1/BouncyCastle.Crypto.dll
- Size 3.2MB
- SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
- MD5 0cf454b6ed4d9e46bc40306421e4b800
- SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
- SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
- SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
- TLSH
  T15EE57B0577F81E67E56ACBB7D1B14012D3F1F82AB363DB5B5882633A1C13B805D826A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  BlueOne Rat v1.0.1/Crypt-built.exe
- Size 3.2MB
- SHA256 af675eda800b00918c764f0f94e35915c1a3e0502488eab1b3b83de07ed747cb
- MD5 ce575ad3e3a695350c96aa3253562c08
- SHA1 7969c5c8b6397a95e788ffddae7bd4abe5a31f3c
- SHA512 000ea9d795ee86b607d80f373dd3bc37ab6b5eebb7db92c96ecadccdba6154d87d14081e5fb1e55160ef39186e5f5d47bed6f28655c08de36219acbd4c950885
- SSDEEP 49152:75710Co7KfRvfCJaBDsfWEsNrzTtu/ALLcfUBUHunx+fUygAHHB72eh2NT3:d7+Cayo0eOEsNrzhsuLUwQ
- TLSH
  T163F57C147BE85E23E2BF87B2D4B2406167F5F89EB3A3DB0B518066791C53B105D422BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

office04 discovery quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral13 behavioral14
- Target
  BlueOne Rat v1.0.1/Gma.System.MouseKeyHook.dll
- Size 56KB
- SHA256 a67a424013544c8270c12633e2e1e287cd5cf0b3f2e81e8d8204b37a03da59ef
- MD5 bfb3bd1cb571360435100bfa6ed2b997
- SHA1 1325e8dd76180a165117e04da4ee4a020e996880
- SHA512 ae5a88a9e86b9e64b8c289213f814586dfa5fe5e0cc21bdbc3e48c36d81fa9e763c6e78f24e40df07696228270ad72f408846125e61e33cae867ef8ff88a3c15
- SSDEEP 768:qYnDJGdu2oE3d7ltSl+Y8sCcm8Doi/L0CPw87qquEZ+r3FhuiFJ8G:VncoU48/AzPwYpNZ6rXJ8G
- TLSH
  T1E8433B3D1BACDA21CDD98B7E90E2014147B0DB9B2983E7976F5DA1F02CEB7640CB115A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  BlueOne Rat v1.0.1/Guna.UI2.dll
- Size 2.1MB
- SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
- MD5 58459aefb74d5ff786b9efb982d44eab
- SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
- SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
- SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
- TLSH
  T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  BlueOne Rat v1.0.1/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 411f8ed8c49738fa38a56ed8f991d556227d13602e83186e66ae1c4f821c940b
- MD5 1c6aca0f1b1fa1661fc1e43c79334f7c
- SHA1 ec0f591a6d12e1ea7dc8714ec7e5ad7a04ef455d
- SHA512 1c59e939d108f15881d29fe4ced4e5fa4a4476394b58b6eb464da77192cb8fe9221b7cd780af4596914d4cce7c3fc53f1bb567f944c58829de8efbe1fd87be76
- SSDEEP 768:Ar5EYZep98C87KHeBUZwrEzsEAnbF+em50KktmM4CRIcZwMRTIzMAtpw:Ar59g98C87KHeBUb5AnZG+zdwMRTzAtS
- TLSH
  T1491329146BFC8B27C29E51FEA4D266060BF19178A513FBA79EC0E5F7BC43B45450222B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  BlueOne Rat v1.0.1/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 447ede1984bb4acd73bd97c0ec57a11c079cee8301c91fb199ca98c1906d3cc4
- MD5 6d5eb860c2be5dbeb470e7d3f3e7dda4
- SHA1 80c76660b87c52127b1a7da48e27700f75362041
- SHA512 64cf4fe7de68a35720d2b9338ba9cf182e127d95d72d2ccf7ff5c73a368133663e70c988a460825fa87b2d03717a4447948d5262f56aceb7c3bf1cb3ab5a41a5
- SSDEEP 1536:2OCAsdBo+am5OMwr5IlALYKXgAJGsZhTjrjvjCXeO:ZCjta0OMuIlArVJGqT/jveXeO
- TLSH
  T1D0938E2A9798EA27E49CB7B660A7090407F0D2B5D583D75E5AC47EF8281FB1215333A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  BlueOne Rat v1.0.1/Mono.Cecil.Rocks.dll
- Size 27KB
- SHA256 2e2623319bdc362974a78ea4a43f4893011ec257884d24267f4594142fcd436e
- MD5 6e7f0f4fff6c49e3f66127c23b7f1a53
- SHA1 14a529f8c7ee9f002d1e93dcf8ff158ab74c7e1a
- SHA512 0c773da6717dd6919cd6241d3cee26ab00bb61ea2dbeff24844a067af4c87ff5cbdb2fe3ada5db4707cee921b3fb353bd12ee22b8490597d4f67ad39bace235e
- SSDEEP 384:70ve8JOuJ5iC7n2NwxEXCni+VXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE3uFLHa9:7+m4iCyrXOhG8uRssveum1pMFLHFBvd
- TLSH
  T176C239012764CB33D1EF853678E1129C03F7C1A66103D7199CDCA6FAA88B7C59B117EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  BlueOne Rat v1.0.1/Mono.Cecil.dll
- Size 350KB
- SHA256 f66f97866433e688acc3e4cd1e6ef14505f81df6b26dd6215e376767f6f954bc
- MD5 de69bb29d6a9dfb615a90df3580d63b1
- SHA1 74446b4dcc146ce61e5216bf7efac186adf7849b
- SHA512 6e96a510966a4acbca900773d4409720b0771fede37f24431bf0d8b9c611eaa152ba05ee588bb17f796d7b8caaccc10534e7cc1c907c28ddfa54ac4ce3952015
- SSDEEP 6144:jIevdbLPNYe8bikm98KXPHhOWY/fFREomhUFD3z:se1PNL+QRfBg/f/EWFD
- TLSH
  T19F749C2223EC1A6BD5DF5B3BE06A042E46F6D01AA74BEB8D1DC5E2FA1C43F535501263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  BlueOne Rat v1.0.1/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  BlueOne Rat v1.0.1/Open.Nat.dll
- Size 68KB
- SHA256 0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
- MD5 cc6f6503d29a99f37b73bfd881de8ae0
- SHA1 92d3334898dbb718408f1f134fe2914ef666ce46
- SHA512 7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
- SSDEEP 768:sF6vHHLFkywkNh5qtHMjkCifoydVXw5FxusiolecziijiSvD+ZGFa4Pw6OdrGHUm:8GmyJNh0tbt3MLQ9W2rG0Ydd
- TLSH
  T166633B0833FC8A22D6FE1BBDA4B506518675F9167832EBCD4A4CA8EA18977C04D60777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  BlueOne Rat v1.0.1/Profiles/Default.xml
- Size 1KB
- SHA256 6c6c26c971d601a35c58ef5a7f19a210c46a7cd0c24d480e1640db678fa1dced
- MD5 9194bb1d5c1bef24717b137a3d74affc
- SHA1 05519abc778af3f92da62a136e03f33c1df96c24
- SHA512 fec9ac0009f28ea289580871f5a2fd046ed4e6f675a5b8abcd2cfaaf1b46dc3a905b12fbfd055c793ccd8bb7570f6210fb7e57f3ca31db98b0e4c4ba20b73873
- TLSH
  T1E6117DB8FCC8716664724331FB219E95BD54CFE9450A0CD8F7C6438B269041963AB2FB
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Family: Quasar RAT

Quasar payload

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32