quasar | 1c3e34166bae09bbf53290138a33d76a63d9019d2a9b5e0a97de9f30c09fe24b

Sharing

Copy URL Twitter E-mail

General

Target
VRChatCheat.zip
Size 43.4MB
Sample261107-3vedyswtey
SHA256 1c3e34166bae09bbf53290138a33d76a63d9019d2a9b5e0a97de9f30c09fe24b
MD5 6b027b60f6a084be99153d8e1cd76e4a
SHA1 cfb61d8eb845f21ae07e5c9b13ce857dcde46ef8
SHA512 386e4bd3eee0d71ac3da4e0bc7590806c4470afe38dcf3692feef095479c0a009de840245cc9d5fef6f47beb7ae1e8db1e1abcdb9f2f08011776d25526980b70
SSDEEP 786432:J2ir3o/usC5H10lrxOr9P4KAolcJFZvZurkTzbQHuotcA7KqcUJ5bJjUykv8SRDM:JB3o/udV0RIx4y+JFgkXUOo7Kqcs5V3b
TLSH
T144A733DB85B4E63FF5B007BBFE9D98636B1545998220877AC603C9F20368F216C5F906
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
3D3A0C0C1FA47AE6FB53C5266A7B4F6056FF30AD
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Targets

- Target
  Features/__pycache__/aimbot.cpython-310.pyc
- Size 32KB
- SHA256 f111708ab1d9d9e66172b442bfc8b33a0ccd4e50d3d86e68ab76f91902069b4f
- MD5 7265965e21ad4ea4040570e7bfac90db
- SHA1 6f5a978310770f5655da7e0f743017d35f4d20fe
- SHA512 43dc2fb214604779af4ab0b9507912c36cd8e3722f5d6eb9272a3c8a988f0c501b4a1f89e2ea215658187ce44d9b99bec074d595f497cef80b41ecc73a1bbf35
- SSDEEP 768:mumpMkkEDMrntOXtlczyczDbwWqztixufAuTQ4Hn:Wbkh0fHn
- TLSH
  T1D0E239C0B1752F5EFCA5F3F8D00916309665B3B9278E9A6B2814F34B3D482CA9E3519D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Features/__pycache__/aimbot.cpython-313.pyc
- Size 72KB
- SHA256 eb6ab6a68d8c715cbefffff1f3d050523192fb70a7716ffd3f4a5e118f43e937
- MD5 44e1f5d22689f474a271bface8dc370d
- SHA1 ff76fdbfe024b4046a3385069e05a3b59eb49ad6
- SHA512 47d264648c2fbeac03226121c6f27c1704def0dab0f687a3d4329463ba7c0950e662fd6dcf922843ae5c90a5e0db03b698b52166aba27cbe216c5f63c2d6e272
- SSDEEP 768:KbFSPHLn3bz522NVg639twkQkHLaXqK2IfCmLfALVQhVx1Dz6rg1g2LYn4ikL:G6HL3TgMdd26K2Z8IVQhvx1g2Ehk
- TLSH
  T1D373C487B9789913FF60F0B894E94444B36D7AC2B655DB23312E46363EDAB69CC2130C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Features/__pycache__/auto_pistol.cpython-310.pyc
- Size 3KB
- SHA256 71b88aa6bd0d72ce60d16c2426c45d0f4352f86b98c519aa8e8de43e7b3849e3
- MD5 0dc53b8086571f83b1a87dd1b5ae31a0
- SHA1 c75e4f749bed13e9b34c82bc70dab6dd2daf0625
- SHA512 e4e877fb179f8cfd50abb13381c0aa63d749dd14d9af8d724f31abad2ab3f9eabd592eeb6739be243c16030f7811b926c2eef7f757ae16f5490da898384a0910
- TLSH
  T13071F681811D14A3FCA2F7BF841D02314EF2621D435A825BB398F2E11F696DD8F2829F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Features/__pycache__/auto_pistol.cpython-313.pyc
- Size 7KB
- SHA256 d4c254c7769e57635691f06aaf50faff902dc1b6eaa6aad4a604370642e5d13e
- MD5 b375aeb94f9d29d11ad104bc9bed57ff
- SHA1 9d1915826f58fcfb91e293118758001d1a9cb34b
- SHA512 1159eef3b0cf3cd1eb241971159a1293afb9c91dc13dae573d718ebee991cb85724af99402b0e4f9858086878d18181cd9704e0f5f8d0b2d442897fdead149a1
- SSDEEP 96:qSp/CAw4iCptVl/tHu8+xWSgEOzfGbyW1Yr2nh43sVt4exbbGmV:qkC838xWzHYYE2u+Gee
- TLSH
  T1F8E1902199940063FFB0F07480E689886BAD6B91FA51D31B361FA3752CDE8FAC980719
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  Features/__pycache__/bhop.cpython-310.pyc
- Size 7KB
- SHA256 baebbb00a8fe81778f85bb72304a8f5bb744787714956a3885eafe08aa7d2d07
- MD5 f61a4db34f079790e7076f90b0f1a5e4
- SHA1 d2805a746c77ef72b1896914099477e2c0576209
- SHA512 d4ae22e9070beb9232afa4a493c2503b85f3d30680c7148e2bc7a1d977f2c85311f6a084ee4c180cdaf3306316a26ef52589bc171417362ef5c9b36e1073a4d6
- SSDEEP 96:6NWcvKFHuXeRMwigzEJvI0hsePCe3S9InQpfzKhF1vwEYqgfPR4DJRhS4AU0nzH:YWgauX2Rf0eaXQslfzDPAU0r
- TLSH
  T1BDF1C680825EAD9BFDEDF2BEB06D42724EE0577D039712621598E2EB1F4C560C83624F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Features/__pycache__/bhop.cpython-313.pyc
- Size 14KB
- SHA256 4917f38b039d3c7238b60b7eaf677752b203e90b3ac85481693ca7cd732657ca
- MD5 98d364463257d0a1c99edda462d2e6f7
- SHA1 4fad5fceb5dbd153102aa060c5c360b4e5be6b59
- SHA512 39b47883d32df75d7f73c72e93a871b4812eaf86e4a32baa2b8634aa52f6f6a1bae6bbec977d4fe2fcb20c69a52e66e4ba76ed94a1a4ae414783826761dda487
- SSDEEP 192:RVgpwhrmTkJMx2MVTHhwVeE+8yP3HOXkL5mBSTFEVppARw7PupJFfup96I32J:RnhaTkJMk/XXBSTFEPpAHfVI32J
- TLSH
  T14D62F857DC54D847FFA8F438B0E919885FAC6AA2F5629323221E827A1DC9B75DC7130C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Features/__pycache__/esp.cpython-310.pyc
- Size 50KB
- SHA256 c190da6ecd23aebc0033580f068bffe28018e5d48b1188dc195153a4382b0df3
- MD5 feb0eeab5d6baab2fa196a1e0ef31682
- SHA1 82b7ff51c36da6c31b8f78dce3da01466cf35a41
- SHA512 3df47582494a6be4b4c174626712c939f4434c88b80885a18298ba75f98dbb9cf1cc647202b5ec762c0c9c4f7755b4d3189fb5e4590df5fec09383b61964e205
- SSDEEP 768:qzJZEoVhaxAA0UFy8pdujYhL5onW5/S4GodKIk/q19el1F8ItMoyDsiP2eLhzkgw:WUfFf7uGL6nIdKI5QlzCYeh7nTB6T
- TLSH
  T1FC335CC6343A8D9FFC10F2BED108055097ACA7662F4C76622048E29E3F447D95E677AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Features/__pycache__/esp.cpython-313.pyc
- Size 135KB
- SHA256 ab1a049b491a7f1c0b4b1fa1160d227fae6de18e8ff080eb199518536300c96a
- MD5 08cda66186813bb8f08fd62f641f01c0
- SHA1 b20b26ca9eb16b1089cb37889cb90d0b5969427a
- SHA512 ebd2fa73ea5a951f4d66d7d58be8f633346089480aed3ec23215855b1fb185a5b6c43baed5fd69caabea1b4a6ecefd0d12206ae84b389fad41a0463e50a5e905
- SSDEEP 1536:9wbZkAmbwdPbghnWjqnHJw7CwuNywNidWs/1x7VVOhyJ20SEboZ02:9wbWU5k6pCwuNkIAbWhW2/EE
- TLSH
  T1E4D3D547A8698927FF24B07898F94458B3BC6E83B714CB27305E01357ADBBA5DD6870C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Features/__pycache__/fov.cpython-310.pyc
- Size 5KB
- SHA256 3baa9924c7b87c01a106626c7b0229da8fdef9683d0e8fcdab125c67507e88f2
- MD5 7d54b0f1a51c1db170d07a5798d74120
- SHA1 5c3b1a3a6577d5dfe00f05cba8e59405ab811335
- SHA512 feb26867ad46c48cf0f1399f45169a9a99ca53646a7a06378aa4fb94d13de5798c1d11762329a3c0f7f7fcf01afab1a34782c12f3ef48a8ecdcd1c0977b0a02c
- SSDEEP 96:eXzipyefP0HeqA79N725ClCaSN+v0QkGfTcuFzFFQg30:eekydv72YIrybFCg30
- TLSH
  T187C1B694C16E399FFDECF3BDF01641A09DE102B993BA1033198982D52F089D1DA3B667
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  Features/__pycache__/fov.cpython-313.pyc
- Size 10KB
- SHA256 1f3778667274a426b5688de482d699fd3668d33e77be636f3185a1e52b8632fd
- MD5 401b35819fd3fdadcb3f73e0df0c5d60
- SHA1 880cec53e767a5fd98fce272f4e9ab9c688d7f38
- SHA512 b7ba43a35714c213005a29fc3c80a0dfc041105b0b09ef6248f0d1e1005ac164ddf117b7513dfa93a07aa84c4fae065d7161efa72d5126e33b167130da75834b
- SSDEEP 192:pMOvSlOL5J2WB9CNImSOcJtulEXNKpvBrzr:pMOv8OLuWTqImSO0fd2vJ
- TLSH
  T1E222A68B5825D966FF65F03CE0E6080CAB7C26D6F610D733221D12A64CCABB5CDA5798
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  Features/__pycache__/glow.cpython-310.pyc
- Size 6KB
- SHA256 a8af32a19e92aec43e9d73cc8d7a9639fd9fc69a6aa719b09da292938fa91be7
- MD5 4a297cb82fdbb77fa5c243b42be211c7
- SHA1 cbb92eb919208a0541adc7060cae51bce62e3c1a
- SHA512 856c1943db42fd5024224c3b6b2d9628b895859779d12ee1e38815def25bc6ab8e88eb1d2ace118c32e8edc60461b6391740494ccd2bfee9e948c42799a85cb8
- SSDEEP 96:iezH2k3oIp9PBZuaqgIHXCsqUB3nddld9oz4C1wqOBRT+3fHYgAUVas:iezWooI/ZcaXMnBtdMpW+3fH/h
- TLSH
  T164D1D8A1914F5B5FFF5DF379A01D1010D5E2B3A6179A22E32810F35F0D48ECAAE2995C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  Features/__pycache__/glow.cpython-313.pyc
- Size 12KB
- SHA256 24682e6a2bec49aa1c4348cd157fc645c2a8fc618d29dc34852f04d804661722
- MD5 dc4b22f523a6000f6aa632f39a699ed1
- SHA1 21bf6ab4e08d2bbf393f94cfa0d0e04f41b54028
- SHA512 0917514f63170d5b02f0e103d135eb221f99917847a653b7f9df4a42f0f93ba6a85197bb2d277f1eddf417f1b132a14eea54ecf491830ba3c1ddef175ec14a7f
- SSDEEP 192:lXSYrTKr7fqClzMumIj9CcD6P8nnDFArSzQGGuwuKPLW:lXznKXfqClzkIjwE6PlrGGuwuiW
- TLSH
  T1F342C58B895CDA67FF5CD035B4E90904A7BD1682FA059763301E127B0DDABAECD6170C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  Features/__pycache__/triggerbot.cpython-310.pyc
- Size 6KB
- SHA256 1a3d72958be85703527f3d4af6f72f87f56e14db95ff8911335a1289420e8cfb
- MD5 912761e89afc5d57209f7d8d2875ee8f
- SHA1 80c7405d09c41e934cb2f45994a710653ccbf7ed
- SHA512 4c1df169e976970b08669a65c6edf4000f0a67e9db8eede41b9ef104bd88290cbe088443e049950981c7c6e1ffdae40fb651c08624318422f3f5d996e9bae278
- SSDEEP 96:4i8yPHeaC63WkpfqVd725ClY05DRzkLHMoENsbRQZaNO8oPXodD6fRF:4i8yu63Wf72YxiPpN0XfL
- TLSH
  T131E1E8D185AB169AFCDCF37CE02B06C4ACA64ABE137B71261508D15A2F0C0E65D2B599
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  Features/__pycache__/triggerbot.cpython-313.pyc
- Size 11KB
- SHA256 1373b950104e612dbed189414bae564b861553373240756e7188065c580a6a39
- MD5 8ee2e17e60de5476130f29067dbeffbb
- SHA1 4bd65eee818c95838a556df114ebfc9a4e2bebc1
- SHA512 45d1eba488ee57a79415c51b9f41d37610fa0ff7bc4277678229790af14604aba82b05532a9624c4f09cebea2aac6e1edb268f21a16d4d111117cdc227bd598d
- SSDEEP 192:SOgxJSWBICNKlyGu4CHUebATt0Nyz/IQzk:SAWeqau9HUeUplz/IJ
- TLSH
  T1CA42F8528915C4E3FF68F0B8D4E60D84B77CA58ABA12D333211E62750DDE3BADC65A4C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  Features/__pycache__/walk_bot.cpython-313.pyc
- Size 5KB
- SHA256 38cd0a83e0d104788ff1438af365768489c73cd3f27bfa07924bd5c92390801a
- MD5 77eda2e91ed9cc06fb3f29b9b01745a2
- SHA1 8c915ec4140d460bbeb5237e502d6747b8393cd9
- SHA512 3e5ce7949bc89a98289876aac7dd52b38a4a85ed9b10d8f8d52fb26603fe5345104d0406e8cdd35822681ab865996169f02f7a6548ae4dc603f5a993fc4968e5
- SSDEEP 96:lbHWsNg9wwy4ZqT5iu72Yo/PUybz5JEWJiRv5fqohiwW:JrNOjs27wWgTw
- TLSH
  T1FBB1859164801807FE38F0B990EB454A27BC5A66FA06DA373B2E22353DCF67AD655348
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Features/__pycache__/worldesp.cpython-313.pyc
- Size 13KB
- SHA256 1c6ff59ac939fe03904dd82e8f6fbbb0a3a42c6887cd88bcfd12c1775bc2fec2
- MD5 b5e02f26e6863522000b929d111815a4
- SHA1 33fb5e5dbc9efac5211e7f91ea7315b0f1205f54
- SHA512 4f439cbbad1fe5f0b5b40ed7cfd8d1b4ec5edaaf93a79ba5e8bf0e4b776be15f49f772777f7d7db68efbb5a6b5a361b01afce5d3b45e9c1e76ac4415ed0d1e69
- SSDEEP 384:bCPo0ui5Jgo4u4yvc56pqOftYAx7BXyANakD1bByDt1:WgPi52Pyk56MCJD641bByj
- TLSH
  T1E152C20ACA10A977FF55F138C8BC0819A6AC9FCBBA61D322390D40311FDB7692C70A5C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32