quasar | 2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat
Size 2.8MB
Sample261110-3ej99scd36
SHA256 7bfb504e3277c3e151df4c76286d53332e259b40597e9114af6ff6a251298096
MD5 3001125c7076ac3c11251e2866d09453
SHA1 f0f417707ea3c86795a482da676cf493a4c8758c
SHA512 39db3a73e5e63f208e0ebfd10b8159d3ea74c898e41b6c64d9166552178ec376251976541299b6e1e7cdd57868d5572ff82e6877db6bef895f29c477cfd32495
SSDEEP 49152:1e9jlRmTYjU9NtY2pWcDxgG4j/OpVwIP9TWG/OpVw1P9:1e9XjS/eGTC
TLSH
T1CDD5BE2177F9422AE2FF5B3AA87145094B73FC529A36CB4F065471AE0E737808E21767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan spyware quasar

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
2F89CD21DE4DECEF4B8A2034B5C7243C56A8495C
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Custom signature

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers
static1/unpack001/exorium.common.dll	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Custom signature

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Custom signature

Detects executables referencing many email and collaboration clients. Observed in information steale 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients

Custom signature

Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat
unpack001/exorium.common.dll
unpack001/messagepack.annotations.dll
unpack001/messagepack.dll

File Explorer

2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat

.exe 2.8MB
exorium.common.dll

.dll 1.6MB
messagepack.annotations.dll

.dll 18KB
messagepack.dll

.dll 368KB
system.buffers.dll

.dll 23KB
system.collections.immutable.dll

.dll 246KB
system.memory.dll

.dll 141KB
system.numerics.vectors.dll

.dll 107KB
system.runtime.compilerservices.unsafe.dll

.dll 18KB
system.threading.tasks.extensions.dll

.dll 25KB

2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7bfb504e3277c3e151df4c76286d53332e259b40597e9114af6ff6a251298096
MD5 3001125c7076ac3c11251e2866d09453
SHA1 f0f417707ea3c86795a482da676cf493a4c8758c
SHA512 39db3a73e5e63f208e0ebfd10b8159d3ea74c898e41b6c64d9166552178ec376251976541299b6e1e7cdd57868d5572ff82e6877db6bef895f29c477cfd32495
SSDEEP 49152:1e9jlRmTYjU9NtY2pWcDxgG4j/OpVwIP9TWG/OpVw1P9:1e9XjS/eGTC
TLSH
T1CDD5BE2177F9422AE2FF5B3AA87145094B73FC529A36CB4F065471AE0E737808E21767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2134078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

exorium.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f014abc29f6169366325332ddaae6ad8c6d813fc86475c333fbec9ba084ff438
MD5 f34ad691a881bda8ba8138da8b791500
SHA1 7bb361e0695eb68f5ffc1b7656406f63bc9e55fc
SHA512 6f8cb9ff3148df0cd4714cd11a6637bc988b6fd612e34e2dc529b97ff65e8266d65a6885fa7acc5eaa207e75ed5e6fff4404fd49d0f58f6dc9b4ed82a1f2c307
SSDEEP 24576:iSfhKTFZXfsUOX+ZErX4vCP6DIFhm93/V1SV/hJ/n3tQHhb:HhKTFlszbi5/V1OhJ4
TLSH
T1D175BE0AF36601E8D92FC078C1294626E67C704E23659BEF1A91C7253F27BE4A739F51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1658994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

messagepack.annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4d7aa07d288c6a39109eedf6435e3ba8c413342876ed08bb5a64d55dd39dd04d
MD5 3876cd00a3ad6d0a5fdbfc19877f300a
SHA1 a0690708c86f009d41fda400fead8407b8168895
SHA512 0cb6821318ab5ee8b5598018cb13d142511b5d033b596ee6d3265dab1d898ac1c07adc784d64d26bceee4a07c980a6e49065209055c8769c09edc4c81f1dac65
SSDEEP 384:/C9rT5pVmE6yc1xEpYF+/vkfLRcwMgjjxPW:Wj0E6yYxiO+/cf1cwMgjj5
TLSH
T14F82E835E398A377DE7B0BB9FC6462610E3AE5487503E63B9708D4572B06BC146A0B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack.Annotations/Release/netstandard2.0/MessagePack.Annotations.pdb

messagepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 067413dff0f9d7a386fe3968cb3988594e68f647c157502ab11d939fc8e2d6ef
MD5 e2fbecbb3953cb5d5de98a38e5323095
SHA1 b57b485ba7372fb3403fd0c36043a051af2afc05
SHA512 25e1fa8e8d78b5d9436255b6995763417ba874d2b16e26ea4f6e03b738994d72ea2468bd566d644e624e810c2ac5548e1e5db0e0024b6c2dab7f30d30e595da5
SSDEEP 6144:c4dxt4Yw//8mlhqkkwqE1zbTmRiVUBa9lssUk80/JssG6WpoY:cJgRD1sdJ7G
TLSH
T146845B9463EC4F23CF9E8E78D4A010064F71C52BB09BE75E418CA5FD3DA6795DA212A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

381926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/MessagePack-CSharp/MessagePack-CSharp/obj/src/MessagePack/Release/net472/MessagePack.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

be:68:48:ae:8e:63:d0:cc:97:89:10:b1:45:84:7f:68:66:d0:47:4a:08:eb:2a:b6:89:66:c1:09:09:16:a3:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5ec0837bb176abf13dcd52c658c4e84c5264f67065b9c19679b6643f7d21564
MD5 af7880a90c02c0115cd169c7182ab378
SHA1 6e3ccf50bb1d30805dce58ab6bdd63e0196669e6
SHA512 5377f83cfb8b9892727ed22ba0b9b1a75b2d4750caa6da04f4eeb0f6f9c0f75949226b2ca00876ad1f4c9de02f8ffb1cbcdb3048fbe6d26a6119148282e818a1
SSDEEP 3072:QBn4ZzK9VbHknD118xm7DnNeHr6n4xJ2WGK8xSSpz5TXui5cb7rq2cAVaSX7hyVY:Qn8CVbHknvteO4xMlpQbHcSzkVaND
TLSH
T15C344A04B78C9B76DA6F89F3B9A0D46A0E72C51360DB739A60DEF7E42CC37949C58094
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

48:5c:ff:60:3a:fb:bd:3e:3d:27:c2:f1:6a:e0:d4:da:f8:bd:6e:ae:ca:08:33:3b:e1:a4:90:5f:9d:70:d7:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

246334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

ae:a3:86:d1:9b:06:39:d7:1c:ad:68:32:06:75:f7:af:5a:40:e4:f5:66:01:12:56:75:99:3b:c7:18:c3:38:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects executables manipulated with Fody
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Detects executables referencing many email and collaboration clients. Observed in information steale
Detects executables referencing many file transfer clients. Observed in information stealers
Quasar payload

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat

mscoree

dotnet

exorium.common.dll

mscoree

dotnet

messagepack.annotations.dll

mscoree

dotnet

messagepack.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.collections.immutable.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.numerics.vectors.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet

system.threading.tasks.extensions.dll

mscoree

dotnet