quasar | 0d1a5fdd4fce2429dabee686f9c068a7a15f271c5881edd1f87f0fefdf9cbeae

Sharing

Copy URL Twitter E-mail

General

Target
Client-built.exe
Size 899KB
Sample260731-wp4y4adm8z
SHA256 0d1a5fdd4fce2429dabee686f9c068a7a15f271c5881edd1f87f0fefdf9cbeae
MD5 f125b7069e85f0dd1528d211a76c4815
SHA1 2fc016fcaeeefdce5a9261a7b41bc3418c270faf
SHA512 c3cfd72a50f274ee83bbfe12e95ae9592930c921a05f362ba0e9d526468c2e629fc55c2adb023e507ba8f9d587c53f9da8579efe668091f2d0a90f0822b534e6
SSDEEP 24576:fdDl5UlSWHIPbcNK0KKfaOwI55l2SR8z1cR:1DlKFEgKKHwCBmz6
TLSH
T11B15F100BBF8C217F1BF5FB6E8B146444BB1F5039A26DB4F0998A0A81CA2751DE91777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.5.1

Botnet

dsc.gg/un1x

tcp.niceports.shop:20936

Mutex

b793e3e0-a400-4de4-b8c2-5204267d2218

Attributes

encryption_key
CB770BFF9A5C5A8F92F2B4E2FE12549CF3DC3381
install_name
OfficeUpdater.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
Logs
reconnect_delay
2997
startup_key
Microsoft Updater
subdirectory
MicrosoftOffice

Targets

- Target
  Client-built.exe
- Size 899KB
- SHA256 0d1a5fdd4fce2429dabee686f9c068a7a15f271c5881edd1f87f0fefdf9cbeae
- MD5 f125b7069e85f0dd1528d211a76c4815
- SHA1 2fc016fcaeeefdce5a9261a7b41bc3418c270faf
- SHA512 c3cfd72a50f274ee83bbfe12e95ae9592930c921a05f362ba0e9d526468c2e629fc55c2adb023e507ba8f9d587c53f9da8579efe668091f2d0a90f0822b534e6
- SSDEEP 24576:fdDl5UlSWHIPbcNK0KKfaOwI55l2SR8z1cR:1DlKFEgKKHwCBmz6
- TLSH
  T11B15F100BBF8C217F1BF5FB6E8B146444BB1F5039A26DB4F0998A0A81CA2751DE91777
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

dsc.gg/un1x execution quasar persistence spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral1
- Target
  aforge.dll
- Size 17KB
- SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
- MD5 02c63f568e598aad85dd401d7b26e82a
- SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
- SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
- SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
- TLSH
  T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  aforge.video.directshow.dll
- Size 60KB
- SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
- MD5 17ed442e8485ac3f7dc5b3c089654a61
- SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
- SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
- SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
- TLSH
  T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  aforge.video.dll
- Size 20KB
- SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
- MD5 0bd34aa29c7ea4181900797395a6da78
- SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
- SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
- SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
- TLSH
  T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  gma.system.mousekeyhook.dll
- Size 56KB
- SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
- MD5 41b34eab1585d5381c56730b93dd1310
- SHA1 510b640517342dbcc40c81b63db23fa1444a71ed
- SHA512 14abe45c04c9620a0f1c4a5ea3882f8388d0d73f497b84020033ce9d3f8d49922694580aedea5e75652101df3c98818f3ebc4ce2865d75e77fdaf3b18b3c354a
- SSDEEP 768:I/t9KqM6Un424sqnGxnRLTxT2Wjq7oEs+DfQ9n5xXK:Ilgl6a424sHXv93ji/siY9ni
- TLSH
  T169436B24835C0337CBDD8B3FA476412A87B1D7863953EBB7AB9881F02867B541929377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  protobuf-net.dll
- Size 284KB
- SHA256 9429f05aa4ab1ef92a0237410ea103cffa406b071953d50f5e7a55496d517c02
- MD5 1c2c6b341535661b7501f5c4a434a78e
- SHA1 f45aefa816f86830bee41c0e5426e641d5af3c06
- SHA512 14b8653b04865a8efeda23149cd624cbe0ebd6e676a7f9cb4ba994a129cba975b9eb928de0f396eb3a37449469549ede36ec2ceec7e61d68773fd72c422fef8e
- SSDEEP 6144:oRxmgHi29FKwOOZmI3jnX2/aNVm12bEm:8BC29HOgmwL2/ao2bE
- TLSH
  T1CF546B1467ED4A1AE2FFA3B4E838181C47F6F506622EFB8D14A091FD5953BD086007BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  pulsar.common.dll
- Size 80KB
- SHA256 e891c3702edeae8e9eb3950c6bf7779b27b0be239cc769f64404c782ec45f054
- MD5 363d4adc1f141288a796e38843ee1cba
- SHA1 eba242776305aeb448bf1cc02c1ec7eca24ad0d1
- SHA512 de4aac6b183efdb97ae2f899a44a81722149ad3c6f5b314f8727813ebf8850b72f951a9dc87dc643ce9734b92f8367697ca4003ea9f552c151572856ff0a00b7
- SSDEEP 1536:sxVxVS8SqEenXZr7dsOPr/BxZ+PFyolZw:QQ8SoJtr/BxsPFpZw
- TLSH
  T1AA83C6119B68C36EC39D47FAF865053E8375918A3010EEFF9B49F48A7D62783600A5B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  sharpdx.direct3d11.dll
- Size 276KB
- SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
- MD5 07137e5cc4d5ecc95ca267c9dce042d4
- SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
- SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
- SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
- TLSH
  T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  sharpdx.direct3d11.pdb
- Size 76KB
- SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
- MD5 1600d8adb3e99f85c1e9719e59828559
- SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
- SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
- SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
- TLSH
  T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral9
- Target
  sharpdx.dll
- Size 268KB
- SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
- MD5 c52a44933d17d576d4c97b4cb0545841
- SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
- SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
- SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
- TLSH
  T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  sharpdx.dxgi.dll
- Size 145KB
- SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
- MD5 d2edde626c241549eab636aa87fb5d38
- SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
- SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
- SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
- TLSH
  T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  sharpdx.dxgi.pdb
- Size 33KB
- SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
- MD5 44e3cf00d4eda7f4aa38044d578aa537
- SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
- SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
- SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
- TLSH
  T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral12
- Target
  sharpdx.pdb
- Size 41KB
- SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
- MD5 2883c3a35927e62ebe1871c130e93f31
- SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
- SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
- SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
- TLSH
  T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Quasar RAT

Quasar payload

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13