General
- Target QuasarTool.rar
- Size 32.7MB
- Sample260825-lta7gazejh
- SHA256 44a3d7861261e74000ab24a7f30ed77cd3027d1791a7b9f27f01a277808192e0
Malware Config
Targets
-
- Target QuasarTool/PIL/_avif.cp312-win_amd64.pyd
- Size 7.5MB
- SHA256 6731dce52baab0b96b0eeb3c664844b5b42c2168ea8668af2430e2fbdd2dfbd8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/PIL/_imaging.cp312-win_amd64.pyd
- Size 2.5MB
- SHA256 c8c519ec72bf75b2945b4fc4afa854af2fca8b970a403134f9ddda3e164d85e9
Score1/10 -
- Target QuasarTool/PIL/_imagingcms.cp312-win_amd64.pyd
- Size 266KB
- SHA256 c89c633ae1bf3f26a327d14ff688db66628e19c9866ab925479f27dcb60a2d6f
Score1/10 -
- Target QuasarTool/PIL/_imagingft.cp312-win_amd64.pyd
- Size 2.1MB
- SHA256 77c6d37de41733df40fb36d9af47644989ac17da036515e759303969edb22c48
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/PIL/_imagingmath.cp312-win_amd64.pyd
- Size 21KB
- SHA256 82ac45c41a008854d05f67deda298b65a7bed850d0d79a3af861ed583f6e7d62
Score1/10 -
- Target QuasarTool/PIL/_imagingtk.cp312-win_amd64.pyd
- Size 14KB
- SHA256 690cc1cae4a2dc8594a342b9241e691dcc89d81dad4cddcefdf285275365a2b1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/PIL/_webp.cp312-win_amd64.pyd
- Size 406KB
- SHA256 9823cebb84f425af3ac1e7437259bc176e7ad7e25d7fa829b0e1a3e55c11be70
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/QuasarTool.exe
- Size 12.6MB
- SHA256 0f7efa1b3966940265cd9d1a31251cabe46a8c354aa25315d2c586547b15bb46
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/_asyncio.pyd
- Size 72KB
- SHA256 c77de90cad749087a0c5dc5e19d78d24f6ef44e7e5ac19b8420cfc0cea62395d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/_bz2.pyd
- Size 84KB
- SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
Score1/10 -
- Target QuasarTool/_cffi_backend.cp312-win_amd64.pyd
- Size 177KB
- SHA256 9af5e4f68a41f26b726f2e9424f9d58a4f5666189f6a48be95f406b257102aec
Score1/10 -
- Target QuasarTool/_ctypes.pyd
- Size 124KB
- SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
Score1/10 -
- Target QuasarTool/_decimal.pyd
- Size 255KB
- SHA256 aeacfead2befcc0768063a037bb64bd32109ae09cb144e5f571b04dd7965db9d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target QuasarTool/_elementtree.pyd
- Size 131KB
- SHA256 5009a9a53c03ef8387443b5cf6ce08e5c3a79727466a0b931c5bbca915bf89ca
Score1/10