quasar | 23f8f157ffac70b2925318416c732d6f0c96b036a59cb5d59f17884d8a5f68fb

Sharing

Copy URL Twitter E-mail

General

Target
VectorCrack.exe
Size 952KB
Sample260709-xepxvsf15q
SHA256 23f8f157ffac70b2925318416c732d6f0c96b036a59cb5d59f17884d8a5f68fb
MD5 8c9084e1212c4448911f98e5a41fd670
SHA1 1c20acb0356cc292f9d0fb9735e8270f2f349c3c
SHA512 5a6db6f51664f391b771c86278dc1c790e9ee8859d52e1d050f87a60e3a07e57d960b420a8770d16acf108656ed57aca8d1c352cc6e774656f577ce3bbbdf8ef
SSDEEP 24576:fF/pixJzck+uGW/yFoBkkAQPqOlFrUOYA:fF/piTYjqqanTScrUOY
TLSH
T10925D09073F4850AE1FF2BB5E8B149494BBBB5529A36DB4F08C490AD1EF37418E513A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  VectorCrack.exe
- Size 952KB
- SHA256 23f8f157ffac70b2925318416c732d6f0c96b036a59cb5d59f17884d8a5f68fb
- MD5 8c9084e1212c4448911f98e5a41fd670
- SHA1 1c20acb0356cc292f9d0fb9735e8270f2f349c3c
- SHA512 5a6db6f51664f391b771c86278dc1c790e9ee8859d52e1d050f87a60e3a07e57d960b420a8770d16acf108656ed57aca8d1c352cc6e774656f577ce3bbbdf8ef
- SSDEEP 24576:fF/pixJzck+uGW/yFoBkkAQPqOlFrUOYA:fF/piTYjqqanTScrUOY
- TLSH
  T10925D09073F4850AE1FF2BB5E8B149494BBBB5529A36DB4F08C490AD1EF37418E513A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Downloads MZ/PE file
- Looks for VMWare Tools registry key
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  messagepack.annotations.dll
- Size 18KB
- SHA256 4d7aa07d288c6a39109eedf6435e3ba8c413342876ed08bb5a64d55dd39dd04d
- MD5 3876cd00a3ad6d0a5fdbfc19877f300a
- SHA1 a0690708c86f009d41fda400fead8407b8168895
- SHA512 0cb6821318ab5ee8b5598018cb13d142511b5d033b596ee6d3265dab1d898ac1c07adc784d64d26bceee4a07c980a6e49065209055c8769c09edc4c81f1dac65
- SSDEEP 384:/C9rT5pVmE6yc1xEpYF+/vkfLRcwMgjjxPW:Wj0E6yYxiO+/cf1cwMgjj5
- TLSH
  T14F82E835E398A377DE7B0BB9FC6462610E3AE5487503E63B9708D4572B06BC146A0B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  messagepack.dll
- Size 368KB
- SHA256 067413dff0f9d7a386fe3968cb3988594e68f647c157502ab11d939fc8e2d6ef
- MD5 e2fbecbb3953cb5d5de98a38e5323095
- SHA1 b57b485ba7372fb3403fd0c36043a051af2afc05
- SHA512 25e1fa8e8d78b5d9436255b6995763417ba874d2b16e26ea4f6e03b738994d72ea2468bd566d644e624e810c2ac5548e1e5db0e0024b6c2dab7f30d30e595da5
- SSDEEP 6144:c4dxt4Yw//8mlhqkkwqE1zbTmRiVUBa9lssUk80/JssG6WpoY:cJgRD1sdJ7G
- TLSH
  T146845B9463EC4F23CF9E8E78D4A010064F71C52BB09BE75E418CA5FD3DA6795DA212A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  pulsar.common.dll
- Size 183KB
- SHA256 2f810da956fed7faf74c8ce2cf65638ccdaa92b282dc7492592d7aedce280c44
- MD5 0020b06dc2018cc2b5bf98945a39cbd3
- SHA1 71ad34cd9f4f3ee2328ca1c7a64a576499208f43
- SHA512 d22590d726892bc8f29045ddace7316141a397b647d7572b4479611fbcb86256ee42abfb73deafe2a376b8a278e782bbdbd871d49c497d96e5ed94110e662d51
- SSDEEP 3072:gI/XTlCoylHtwpX+oK/993NTA2h0/5F3tMLUnejNXHsBbYw2krf+Gyzy:d/ZCDSK/99dTTWejVHgS
- TLSH
  T1CF04D5412694EF6FD6AE15F8F02C412657F4D54932A2EBE6AB8674FFBC1274204602F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  system.buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  system.collections.immutable.dll
- Size 246KB
- SHA256 d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
- MD5 af7880a90c02c0115cd169c7182ab378
- SHA1 6e3ccf50bb1d30805dce58ab6bdd63e0196669e6
- SHA512 5377f83cfb8b9892727ed22ba0b9b1a75b2d4750caa6da04f4eeb0f6f9c0f75949226b2ca00876ad1f4c9de02f8ffb1cbcdb3048fbe6d26a6119148282e818a1
- SSDEEP 3072:QBn4ZzK9VbHknD118xm7DnNeHr6n4xJ2WGK8xSSpz5TXui5cb7rq2cAVaSX7hyVY:Qn8CVbHknvteO4xMlpQbHcSzkVaND
- TLSH
  T15C344A04B78C9B76DA6F89F3B9A0D46A0E72C51360DB739A60DEF7E42CC37949C58094
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  system.memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH
  T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  system.numerics.vectors.dll
- Size 113KB
- SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
- MD5 aaa2cbf14e06e9d3586d8a4ed455db33
- SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
- SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
- SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
- TLSH
  T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  system.runtime.compilerservices.unsafe.dll
- Size 18KB
- SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
- MD5 cb5b861883d2bddd9833c9fe956406f7
- SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
- SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
- SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
- TLSH
  T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  system.threading.tasks.extensions.dll
- Size 25KB
- SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
- MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
- SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
- SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
- SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
- TLSH
  T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

Looks for VirtualBox Guest Additions in registry

Downloads MZ/PE file

Looks for VMWare Tools registry key

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops desktop.ini file(s)

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10