quasar | fdcb6d6dccea88ba41367a990f6e3cdc1b22723bfa694ab8e8000fc8c751b462 | Triage™

Login
Reports

Overview

overview

Static

static

Include/NCC2.dll

windows10-2004-x64

3

Include/NCC2.dll

windows11-ltsc_2024-x64

3

Include/NCC3.dll

windows10-2004-x64

3

Include/NCC3.dll

windows11-ltsc_2024-x64

3

Include/NCCheck.dll

windows10-2004-x64

3

Include/NCCheck.dll

windows11-ltsc_2024-x64

3

Include/VS...in.dll

windows10-2004-x64

1

Include/VS...in.dll

windows11-ltsc_2024-x64

1

Include/VS...in.dll

windows10-2004-x64

1

Include/VS...in.dll

windows11-ltsc_2024-x64

1

Include/VS...in.dll

windows10-2004-x64

1

Include/VS...in.dll

windows11-ltsc_2024-x64

1

Include/do...le.exe

windows10-2004-x64

7

Include/do...le.exe

windows11-ltsc_2024-x64

7

Include/do...or.exe

windows10-2004-x64

7

Include/do...or.exe

windows11-ltsc_2024-x64

7

Include/mpress.exe

windows10-2004-x64

3

Include/mpress.exe

windows11-ltsc_2024-x64

3

Mono.Cecil.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows11-ltsc_2024-x64

1

Mono.Nat.dll

windows10-2004-x64

1

Mono.Nat.dll

windows11-ltsc_2024-x64

1

Quasar Gol...on.exe

windows10-2004-x64

3

Quasar Gol...on.exe

windows11-ltsc_2024-x64

3

Vestris.Re...ib.dll

windows10-2004-x64

1

Vestris.Re...ib.dll

windows11-ltsc_2024-x64

1

client.exe

windows10-2004-x64

client.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Quasar Golden Edition 1.4.1.0 .7z
Size 3.9MB
Sample261023-zbmdnsdw91
SHA256 fdcb6d6dccea88ba41367a990f6e3cdc1b22723bfa694ab8e8000fc8c751b462
MD5 8c39c3974a665139a19d5e9aea6edbd8
SHA1 b59f025b5bd88a0413a2b08720ea0ffc76e5fdda
SHA512 91b4ab17d368e0ea02ecf939f6228416b0971743afb93e967a8ef2f78078e3ada1233be04430f2ebe9b17991b0e7b35032297e43e35e88ff9b5b969f6ec6c4df
SSDEEP 98304:EbeyMwD/T4NNcabjrcKm328U7SPczV55xJQm:9yD/TJ6rJ5Nj5xum
TLSH
T13B163313E01B184C8E9B9B85E02FB4F20A89EA5561C7CD74D2BDBF86CB36DDE4385251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

quasar defense_evasion discovery spyware trojan

Static task

static1

4 signatures

trojan spyware quasar

Behavioral task

behavioral1

Sample

Include/NCC2.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

Include/NCC2.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral3

Sample

Include/NCC3.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

Include/NCC3.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

Include/NCCheck.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

Include/NCCheck.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

Include/VS08ReactorAddin.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Include/VS08ReactorAddin.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Include/VS13ReactorAddin.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Include/VS13ReactorAddin.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Include/VSReactorAddin.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

Include/VSReactorAddin.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Include/dotNET_Reactor.Console.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral14

Sample

Include/dotNET_Reactor.Console.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

6 signatures

150 seconds

Behavioral task

behavioral15

Sample

Include/dotNET_Reactor.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral16

Sample

Include/dotNET_Reactor.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

defense_evasion discovery

Behavioral task

behavioral17

Sample

Include/mpress.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

Include/mpress.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

Mono.Cecil.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

Mono.Cecil.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

Mono.Nat.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

Mono.Nat.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

Quasar Golden Edition.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral24

Sample

Quasar Golden Edition.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral25

Sample

Vestris.ResourceLib.dll

Resource

win10v2004-20260911-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

Vestris.ResourceLib.dll

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

client.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

3 signatures

150 seconds

discovery quasar spyware trojan

Behavioral task

behavioral28

Sample

client.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

3 signatures

150 seconds

discovery quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
reconnect_delay
5000

Targets

- Target
  Include/NCC2.dll
- Size 13KB
- SHA256 a0b6bb521e52a99abf5ac1017302da014d37296619078d42d9edf5d86d137f63
- MD5 12e7983a050a5f7f7b501d3cda914248
- SHA1 6ce5d9b763fc05dcdfcaea79a62a8352371d749c
- SHA512 0b8788c858c35e0f8f56d552518adb71c847240f6d7c199243e046c4c2e2ae32cb035a0bc5098631656c5d7d772be4fdfdc6a4e19e00092fb3eb09044998be97
- SSDEEP 192:jKsAWXvf+AxcTC6xFrnT5xoqMSqzqqJocD/HCtVWAc3XTEqx2CvAPhz:9Z/f+XT/xBwqMSqeqqcmUDhKhz
- TLSH
  T158520906EB43C132DA8951B16473533719B95DA003C714B76B97FE892EB12C46E73F8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Include/NCC3.dll
- Size 72KB
- SHA256 38274608d5a4b53ec22f8099f798ba46ce0ed41db65a33dfb3853f0dbf849f6f
- MD5 aa84f91edd922e7b3bb979e663c94f1a
- SHA1 da46b9962a6c6cceef38c3e11b8b5bc9c1b536fa
- SHA512 88392fc77a0300ece306908867be38011530d9eefdf003452ba86d82f2fa4a61c2b27a199f376ac307c095beaa4f52cefcab59c8b28fa187c0bca13f55f2d98b
- SSDEEP 1536:a44UF/3qab79HtYDAD5MPEBq9iNv6qfSOBHfVW:a44G3fRMPiuuv6qqOBHfVW
- TLSH
  T1D9739E317E41D076FAD60476D9FEEF260A3AB29197DC21E72F9407984D907E23E3421A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Include/NCCheck.dll
- Size 162KB
- SHA256 c41cd461470ff3c936e225cea37e5190cb06e3cd70a3d76ca8e5d3aceead5493
- MD5 569052631a6b80c1c6a336c10c978b02
- SHA1 4bc411b19536c90a6ea0917d7d93f3f6560ee6f0
- SHA512 d0e251973a0c6b3fecaa41d9042c7001e4e9e20484fe2ed9ed1ce04a416952054cb010bff6643c0fa093ac60bbe079c11ba0d6f9699224a3db7a56fdbc4f7f69
- SSDEEP 3072:iW3Hj+g/SFOANotkow8WZT75Izm04x7RP+iH3D1VIkB5XFu9H:v36gp5tk5Nx1P+iH3D1VIk6
- TLSH
  T145F309E3B7C04576E17A1BB88CEB6321777EFC302E17570BAE582A599CE83D01D24646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Include/VS08ReactorAddin.dll
- Size 133KB
- SHA256 1952313f3a5c3b4e7a1269238dc070301c356bfb876471332d6439b6d3eefd12
- MD5 b4c1e8023be1bd3af8425885ed5d02ce
- SHA1 0d6e7eb3f8a6a442d7f7c030ddb0bdc5d907deed
- SHA512 be0dec723b045afba3799435329b4c6dfa19997a4ba23725236f449990392f8531574eef1bf786bcf36777e7b72314d7210ed9e5508b114ae9a4112613436401
- SSDEEP 1536:J1Ep+y0dr95DbEX1sJOSJCZQweMdYU+ZQweMdYU9:HS+y01fbEX+JOk
- TLSH
  T1BAD3E5023AECC514E6BA8571C6BB06F407B6BD06C523D50F2DCD7D8E3A74B929A01B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Include/VS13ReactorAddin.dll
- Size 134KB
- SHA256 5e0efbda4f047575e7b7cd0ef047bddc7b05d5225f4a98a7d1ac93e28471e742
- MD5 11ca1dfec3eaef207f6393d307cd5815
- SHA1 c3e8d5267c6c295a0124dd396026ab07bf28ab09
- SHA512 bcac4268e3baf11ae8b8a87d6227f36b3c998040ef5301da5fd24e273d04827a74a5e027feb11decfddacfed2bbd2f86889fde63acf4e5c5c8adbc0e1b7ec935
- SSDEEP 1536:xNfSLgOxb0fEonTpODxuHfr97OCzF1KRsNVpbdTRkr1sJOSJ4ZQweMdYUsZQweMc:xtScE8TIDefr97jFARsfpbd14+JOL
- TLSH
  T11DD3E6027BECC914E5BA4A71D6AB06F507B1BD02C522C54F2CCD7DCE3A75B929A00B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Include/VSReactorAddin.dll
- Size 97KB
- SHA256 a2629e2c3bf06260116bd88b07a8ee4fc8846367c9d8de53608ad5b4aadeb9db
- MD5 afc9814513e9cfb6a7905f1e6186e195
- SHA1 641c75d7f0891fe5a4007b57cff863ee667a6d29
- SHA512 34ec4738c20b16fb22f600b0be84647a127d7c134365d53e78b8b3fcc5b38a4a91390503fd4d445b439831fe0fbd4a5bfa70216dc53c8df5daaa2b9f084a5f50
- SSDEEP 1536:mnQAvDNONuHEEJTRkfLCbZGCZQweMdYUA1sJOSJE:lAvJKukYdkObZGt+JOt
- TLSH
  T172A3A30237FDD914E1BA8A71D6AB52F407B2BD46D522C54F2DC97DCE3970B828A00B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Include/dotNET_Reactor.Console.exe
- Size 14KB
- SHA256 e817802f166662a7df0b144571354d74b10e34d120f91ae9d84ca3ba925241c6
- MD5 0b4dbf61a98f3e34cdd3a1b08a6a4609
- SHA1 73587f1f5d040541b230513d22d696513dbd4cf9
- SHA512 7cca370890e4e245c84507623531b5f54b76ced3e8c6b87cdfc47ed16560b6a0a5cf9e0556075cd0d9266908e445b854114edd69d50870839624589676c0e688
- SSDEEP 192:8jY53csvsqHwrHEdSAejbMfDn1Gp78dsKGXOdlWW1ksTkwy:8jEnskskQlm1GRJKGXOdlWW1XTR
- TLSH
  T15E523CA8F796C21FE7570EB84C925F3386F4DF91947A4B698443F28B0CB67890D216D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral13 behavioral14
- Target
  Include/dotNET_Reactor.exe
- Size 5.8MB
- SHA256 1efc5368bcd9704d7df85e2e143936d6ee4509ac31a7ca6d3eb4cf3b18c5ef27
- MD5 7429e30caa2a8b41d926ffef1a05b347
- SHA1 32abbd56225cd7379bb1cca8f6749d43916efe2b
- SHA512 55243a97d9a7fcd43d531bb61615e734c8bfea242f6e28d67ce09cee586d032d83709a3b8c4ecf9b567252a53d1dad1853aca669316aa2ae62422386156b77c1
- SSDEEP 49152:VoMLez0fgPdLl8HC5IaKSihCwc0YMOBf7BfKjGO+XYSaqNuT1i:Vy0fgPVwy70GUO
- TLSH
  T156565A2476E8C952D5BA8770F2F246FB4BF1BD2AE226C31F11957FA539B1B400D42623
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery
- Loads dropped DLL
behavioral15 behavioral16
- Target
  Include/mpress.exe
- Size 101KB
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH
  T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Mono.Cecil.dll
- Size 277KB
- SHA256 3e4288b32006fe8499b43a7f605bb7337931847a0aa79a33217a1d6d1a6c397e
- MD5 8df4d6b5dc1629fcefcdc20210a88eac
- SHA1 16c661757ad90eb84228aa3487db11a2eac6fe64
- SHA512 874b4987865588efb806a283b0e785fd24e8b1562026edd43050e150bce6c883134f3c8ad0f8c107b0fb1b26fce6ddcc7e344a5f55c3788dac35035b13d15174
- SSDEEP 6144:iYOMWAEq+PAEwGQ9Xivs0s4EtS1Fv8jnLKdFvkPo2:AG+PpjQSHv8jA
- TLSH
  T1F4546C2567EC5A7BDA8F837BE0430C2947F5C527724BE78C9C9C91FA1D07B998A01263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Mono.Nat.dll
- Size 40KB
- SHA256 b33435ac7cdefcf7c2adf96738c762a95414eb7a4967ef6b88dcda14d58bfee0
- MD5 bf929442b12d4b5f9906b29834bf7db1
- SHA1 810a2b3c8e548d1df931538bc304cc1405f7a32b
- SHA512 9fcfaf48bfe5455a466e666bafa59a7348a736368daa892333cefa0cac22bcef3255f9cee24a70ed96011b73abea8e5d3dbf24876cffa81e0b532df41dd81828
- SSDEEP 768:yoVesKx0V2LpibQJxoKUDHj560aSX3zlJAO:lVespQibC+H56k3fF
- TLSH
  T171033A0663FC8B2ED6BD1B7E78B154044AB4F6056922EB9E2D88D0DD5D63F844A21373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Quasar Golden Edition.exe
- Size 11.0MB
- SHA256 f157877dacee3384192d3438d6d6c4dd7f25eb313a45bd0799e15d90b4eb3114
- MD5 d49e5e8dd0e5e347b9bb061aa9c328dc
- SHA1 d97c692a5c927f2db65c6ef9a240b061bdd668ed
- SHA512 251b589318a39395dd8c40c0b54e6d000d60ce76710105d46059ede584ed939280c7f4d82ed513a5de224deb81f1213b2993301fd6134ebc796dd9b4283baef6
- SSDEEP 49152:wE6zazjZSu8fiiiiic1LF6sjVWqvsLkUS16PVQaJbHJBSiiiiilsiiB9iiiip:wERZSu66QVWqkLkUSYPVQarBN
- TLSH
  T1ABC6A6D66239E401CD510E732C0454FB8B32AD3FDBEA652621D6376A023B59B6D2E1F3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Vestris.ResourceLib.dll
- Size 76KB
- SHA256 34cab594ce9c9af8e12a6923fc16468f5b87e168777db4be2f04db883c1db993
- MD5 64e9cb25aeefeeba3bb579fb1a5559bc
- SHA1 e719f80fcbd952609475f3d4a42aa578b2034624
- SHA512 b21cd93f010b345b09b771d24b2e5eeed3b73a82fc16badafea7f0324e39477b0d7033623923313d2de5513cb778428ae10161ae7fc0d6b00e446f8d89cf0f8c
- SSDEEP 1536:5Z0R489PUoltCY19T7Uf5DYoRvtkA2MNmjYgGKeK9jXGYWs:L0R489PUeCy7Uf5pVCMwjVG/K9jp
- TLSH
  T17B730928677CCB26C7EE037EB466441657F0C516A267F75E8DCCB8EAA89234136502B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  client.bin
- Size 278KB
- SHA256 3ae294870c3f566d1fa8d05c04930b6a60569d23c4341dd1033f41530a3e8e6d
- MD5 19a3ab679df06aaff3d972cd014ca769
- SHA1 fec74fcf958bd3effa02ae046308961f6a79cc54
- SHA512 41206553caab7a86e3ecc0e38a75ead6a74a5be358c53ee3a4902a367999409de8d381460ed3a20b9469c44667d1778bf7bd6fed728fc404c6c7e24afb5f589b
- SSDEEP 3072:Ha0HvWfZu5YLCQ0eiGXkvg3TRP4QpaFtdwlj/jDLfXeLepb0t7mAq/37ua/C6Pee:9pQRiGXkIjRPZpYfwlTTXeypb0tqAaT
- TLSH
  T1DC546D0073B8C9AEE4EE0779F03308155771EB1BB576E39D7A5A989D3D2338582817A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery quasar spyware trojan
- Family: Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

trojanspywarequasar

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

defense_evasiondiscovery

behavioral16

defense_evasiondiscovery

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

discoveryquasarspywaretrojan

behavioral28

discoveryquasarspywaretrojan

© 2018-2026

Terms | Privacy