Extracted

• • Target
    net472/Client.exe
  • Size 2.6MB
  • SHA256 b84ce7904315540f54bff28b1826ba7f76de4476c9f6ebf01e9460d8420bdffc
  • MD5 a1c157a6ba62a9af39d48cf97740617f
  • SHA1 8c4646ebf6f77855025033233e2b31713b90401d
  • SHA512 4fb7c2a08be6ae7eeaad837554e0c33faa7b3d0880acf03d2e57c34edbcd8e07e390aef714d095ec16accbde2c1099d5d6bc5ee3c790418d42f3266aed148267
  • SSDEEP 49152:7Pl6t7Mxi8/N+ZZXZQOLHM7wRPirm2NnPTKKm77LrwCB6uants:Dl6N+i8VIxpL7oZNn2Km77LrwkFWt
  • TLSH
    T13BC5F110B3F9811AF3BF1BB8ABB6144D1BB3B503D639D79E188850AD0EA33519E51763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  quasarmoduleratspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  behavioral1behavioral2
• • Target
    net472/Guna.UI2.dll
  • Size 2.1MB
  • SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
  • MD5 58459aefb74d5ff786b9efb982d44eab
  • SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
  • SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
  • SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
  • TLSH
    T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    net472/Microsoft.TestPlatform.AdapterUtilities.dll
  • Size 28KB
  • SHA256 2570cbe12e3f6c177362eaad630b42db3114c2bb74099a0baa2d3abd6bcb5303
  • MD5 2e02f737baabda557d62c88443ae7c01
  • SHA1 a4f3a6a3b7c5d371474fbb9a4d51f0e75ecc0927
  • SHA512 646c34a76dd20c808346e87bd68c6074fddc3194df0cfbab345e2e08d8d480fdecd6e544836a07f74898d4276fd7f30b964aa0fa260178492639913e7beab650
  • SSDEEP 384:MoGlVXd5QgRbo/cqR3gMdny654nKDdhUauvc//FyHRN76JVOY/wR9zmuyzy1:wDOgRcOIUarFu4/M9zmO1
  • TLSH
    T1F2D26C1597EC940BEAAF57B920F0E9121A39F3E61502EF5E5C84E01D2F93BC1972072E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    net472/Microsoft.VisualStudio.CodeCoverage.Shim.dll
  • Size 15KB
  • SHA256 3a4ed9b3e4b5d706767ef614b52836250e8abfadb7b8e30e3706c2eb9d1c45e3
  • MD5 b0f2e37dc0fbe6cf01672547f9e56e5b
  • SHA1 2673eb1ab737217e0dc63101d697697c82547185
  • SHA512 8c5f91a0a7bcd44d3f4a61d7f37f9956f7aa0f1d3585460c2eb1f27bb28e6b959f1e3e7ace6b1fe2c39b06c121d024b6bd383ca3c403ab70dfbb94208476e6de
  • SSDEEP 192:LnIqrxCb3j0WZqnWSW1R7KOTYRHnhWgN7a8WqJ2sJact5equ/X01k9z3Amj7x+M:Ln98j0WZqnWlyHRN799Es56/R9zTjVP
  • TLSH
    T1B562399AC7A89347FDEB6D7066A4D9873D3CF3C399519A6E0085F5481D633D0EB3022A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    net472/Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll
  • Size 155KB
  • SHA256 cb1d59fd79a412b1b05a27b32c342cbc85f018a9f1e1d67b43ebe87e43fec0d1
  • MD5 2ddc54871ff84b3692ad11ba4a5ff771
  • SHA1 c5310fea5760851117ec68b66363f65d5fae06a3
  • SHA512 c4b6f1f0a1517b7669813f58ece0b10432dd85e1769584b5502cbb0bf0b440a56353b1b5142aa024886d0a4cabe9447c8ea6173887ca9c7562e5883deac07ef0
  • SSDEEP 3072:vIOjCZch+OpRvMKZNZ3hy3B5HZtdOu8uThF9hZlJ8jaoY:jGZc5HvMKZ73Y3B5HZtdOu8ShZlJ8+l
  • TLSH
    T141F37B3453ED861AEBFF5FB075B070240BB6BA435911CA9D4D84A4DE20627E0DA317BB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    net472/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll
  • Size 18KB
  • SHA256 c4494b603ecb322627959b2cd782400405a58051229bd09b108861415b1845aa
  • MD5 f0bf68ced49e25d46f470d063b9b2532
  • SHA1 5826195d195ba3317b22fb726e60231e800571ec
  • SHA512 01eff16e40fadab3acc906c3d7b046363649157ff152a58babff0e7300861b16de8254237b6f39dc781bb2b0609f24ec8edbc816b1dda27bfa71d8816c3470c6
  • SSDEEP 384:jFNFUt+ZDmwKCWKhyHRN7/FfsRmuTcR9zuskT:jF7kwDhutERmuU9zuR
  • TLSH
    T1D3925B86C7ACD607DEB7697239A6DA033E3897C65911EB2E1254E80C1CA33C4873077D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    net472/Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll
  • Size 111KB
  • SHA256 dd7eda88da0e3843202e51ba2cedc4412a566355c0193b4c781d307d3d1e5a4e
  • MD5 6e970809dfb2a09768bdc1f90ba138e1
  • SHA1 c7d2624aff1f91641cf2bb0fae0ceb109097ca6c
  • SHA512 87dca21ef73a5aab745a6902462c70ba23a6bb14f57c9d89f6a229ee876ba92e927cb0add7ec8a1b2bc12a460f2ff79f6927c48b1f6b71452b3350c154fc781c
  • SSDEEP 1536:iUAeczX41Bugzu2e8vZTydXOBBsjoihtVfKFFeCbMNflzlrWi2QzgNUw8gKAh8Ia:DGX41Qgzu2JQ1oihtVfKyC8zoQMR8I8b
  • TLSH
    T124B33B6533FC4709E6FF2FB579B290660BB9B7469C32D31E1984A45D0972B808A32773
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    net472/Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll
  • Size 33KB
  • SHA256 8d1c36b6dced0b1315e71303ef205dbd01d157a4add72d874825e0f26c529aa5
  • MD5 e3306bf4a03b415eeaf5e3038245146c
  • SHA1 7c1287fb75cf863bf61d315a5dc6ac21bc224584
  • SHA512 c1360bfd93a0aedbc06c58c79b3ffd6b5599d70b49f5f894bc793332f27f315ed6e3609984a269201064e73987517109fe6b720cecb38fc67ee08e1258cf843c
  • SSDEEP 768:cfuKfVp4MAfCQxA5Xm9nCSqu1LxWF//dj9zw:64nHI29dqudxWZzw
  • TLSH
    T121F23CDEAFBC9116CFFF1D78E441C8411931A3872423DB191ACDF21E2A53FC566126A6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    net472/Microsoft.VisualStudio.TestPlatform.TestFramework.dll
  • Size 72KB
  • SHA256 9dddb3c2958a276f6b6afd9fade11cca191e2f0635f29a39718c60f8f278a4c3
  • MD5 81930cfe170acd3a8e7498fd706a93c9
  • SHA1 e1868f03638b3b94027afe2c4f1cda84d39c1054
  • SHA512 1120633361c962a6828799898b2c43ef72402f6eec3d40761e875bf5fe08cea77cdef762f6b8840b6a747a534427af2f0b54ae906c39753a7facb17ff52949aa
  • SSDEEP 1536:CHXw2c75z0KqmKkONYfVmiCpmivfD7XXyAHHof0qokuUz2:u+75zamKXqfVmjnD7XXyAozo4i
  • TLSH
    T1B973193953FCCB29E7FF2EB07D3550A85B36F5489902C74F1888D06E2957B94A9312B2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    net472/Microsoft.Win32.Registry.dll
  • Size 22KB
  • SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
  • MD5 da40f3db8b34571684c0cb5bcecd2a79
  • SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
  • SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
  • SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
  • TLSH
    T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    net472/Mono.Cecil.Mdb.dll
  • Size 42KB
  • SHA256 570a437dea0271d1d5c8b7d6a408b0b2635bdb0e8b8d5051878f3e7fca087f89
  • MD5 2c39a53a61168c8a7a9f53ebdad6137a
  • SHA1 b10ac8325cd72c7a9018af806d75739ab862b4d8
  • SHA512 d1987995bb58978a063a195a18ba02908edac02a3e7808e93f8340aa968c9bd74f76d2e6fad8158f72bc3629c1382039863471d51e510bd897187ccdabae8e14
  • SSDEEP 768:wlUj6BAKp/zgvVucdcRsCVKcraB09THkPFtQI4CRIzZwMNTBczwDN:0h3/zgvVPcRrK09HkBAwMNTNN
  • TLSH
    T135132A1067AD9B27C2AD8AFDF482911507F09125B623FB9B9FC4F4EB6C47B85050227B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    net472/Mono.Cecil.Pdb.dll
  • Size 88KB
  • SHA256 50a1a1a79dc86fcfb8b51249b5325a10dd93d193c52999cf6775d25030a4e606
  • MD5 5f6a2f17f4e792600a13e3771d5ca5ff
  • SHA1 e411b8e51b201c5f389c2388d26735c1e89b3f6f
  • SHA512 67af09a5545c6bb0e033cfa09dfc654ce4cd4d22c418402d5a43612eaa6e60b71dca2bf4f796a6027c8e7aece88d418e6e8c469c94c327f5169608e67a3e7a39
  • SSDEEP 1536:TexPta15J8wWI7Kgl74TChe44tALYKXybJG3OoCkvV:TexFafB7q2hwArQJGFhvV
  • TLSH
    T137937E3A9B98FA27C3ECAD7724A60D0907F1D126E153FB55C98959F8381BB301232797
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    net472/Mono.Cecil.Rocks.dll
  • Size 29KB
  • SHA256 842e09959084eda733aab1a5354d7af79e29594f4d8b91c8792103e5c755ed9b
  • MD5 e136924bb4051a462ad90bd14cb0ba41
  • SHA1 8cfeb4034766ce06f9216b1872703015e8ea0e09
  • SHA512 1baa852ffa42fd8a743661f003b90c840276b4cd864d5467b8d551454420ea46bb6c97e0dbe832de1e5e0672eb57365332dd5f86ad1df88820300504a3b1ea07
  • SSDEEP 768:628hQuem5RPkF+pXtRx/hRsPveQJcpAUdE3fF7Mtm3M:62gYm5RPv9jjsPveQCdEvF7Mtmc
  • TLSH
    T1B2D229022B68CB77D6EF4575B8F0212842B1D39F6803C76E4DCC61E9A947B8567217F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    net472/Pulsar.Common.Tests.dll
  • Size 6KB
  • SHA256 8512edb395953602f30ccab68d15cf1782b72c692ab294343c3e57963ac283e3
  • MD5 2b8a1b15edefe739fe68a6ac74bf22ce
  • SHA1 5cbedb6887a0856fc132fb59602b2d0c4af31041
  • SHA512 006f571d51b90d1ab790da08e8fbd8b006e09f5a83d770dcb8d2e2486078a800ba179ab656ef4bb5e8e3e07d55a4fb069a71ba1a3e9b6a0bbf36f53d7a5b7b0b
  • SSDEEP 96:UW2zmDjGTY4XpcGD/pzLrQQKhw/ZjuKvEuhCd0yLHgiOYyv5:ByTYicMFCC/hLhCd0jf
  • TLSH
    T10BC19529E398C331EEBE1BB4EC73D3A012B4F750FA239F6E0489A1195C2530A4575BB5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    net472/Pulsar.Common.dll
  • Size 93KB
  • SHA256 664010a92d91b81a36777b617d40d15e7b05d3cdbe796c0d95131eef3f3fcfe4
  • MD5 8d08ec80b7d5fa3fc342cde3573b7919
  • SHA1 0a09b7af99ebf865b6edd3796a26d89352976b5a
  • SHA512 ea751ccf0c3371d01471e64dd16dba1476ee224bafdd6901e8c14a4134e1fbd3cd173b3a061c1796f4a435391b6d2651c5769126e13592fd67c82e60a4c08b8d
  • SSDEEP 1536:e1ivjrJmTgz8N0Jh824GpBlRvXVKr5m0kR1mN7aDFfT7sUHrU2:epTa8N0AOvltVcfAQcxnsT2
  • TLSH
    T16093C35053A8836EC6DD0B39F0A646F6CF71A50870D0E6B6CF42F8D93D17782694A9F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    net472/PulsarModified.exe
  • Size 6.3MB
  • SHA256 f258ccbfce1e10daea3244538bdf0f84a2abe7949fffcabfc51a8aa29c3c6aa5
  • MD5 93e5eb70e97d756bd61afdd64a3c428b
  • SHA1 06c967c69edd343350804658391b900dc5fc0452
  • SHA512 7e0ccf2793cf7e8f0285d37528342b88f1c9843fd08952bd052406675519bab0ef963b630c831ddd22476fb6a8896f98e9f3167c877e06d38633b951984dc1a6
  • SSDEEP 98304:h+9MMMM0maMM0e9w0M35M0YMM0M0MMMMMMM00M0M0e2smzG07hTIF8TkqXf0FgUV:02s2ISTkSIgUcwti7TQl2ZNndW3Y
  • TLSH
    T18D66BEB9629C7085E25535F00852D4B0E2E36D3149B3656A68FF3D6B39B2B27CC0279F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  modulerat

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule
  behavioral31behavioral32