General

  • Target

    41dcaf4c90164544df7f6355059f9d31534a72ddcd310729332ef1af1e304a29

  • Size

    8.5MB

  • MD5

    0685c534129f6c16803965e24bb95157

  • SHA1

    34dfdf16d13f974a06f46486ab4ad7034db8e9d5

  • SHA256

    41dcaf4c90164544df7f6355059f9d31534a72ddcd310729332ef1af1e304a29

  • SHA512

    d05f6f88d6acbbbb8ada8e8a17c6b638072ba203ffc44a61d24cf2eb387bbfeba1693bc690c636b1332aab2b1da6208a04a5ea259ef424e3ee1c840118230c69

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

PDF

C2

https://web.sunvn.net:4782

https://taisunwin.club:4782

https://web.sunwinvn.vip:4782

http://b29.bet:4782

https://playgo88.fun:4782

https://choigo88.us:4782

Mutex

ca1a9340-65d7-49a9-b045-50c69210b55d

Attributes
  • encryption_key

    9C84151BA76B2D40C2A4C55E8D137720CE7C0137

  • install_name

    PDF.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    PDF Reader

  • subdirectory

    PDF Reader

Signatures

  • Quasar Payload 1 IoCs
  • Quasar family
  • One or more HTTP URLs in PDF identified

    Detects presence of HTTP links in PDF files.

Files

  • 41dcaf4c90164544df7f6355059f9d31534a72ddcd310729332ef1af1e304a29
    .zip
  • The increasingly complicated Russia-Ukraine crisis explained.pdf
    .pdf
    • https://www.vox.com/22917719/russia-ukraine-invasion-border-crisis-nato-explained

    • https://www.vox.com/authors/jen-kirby

    • https://www.vox.com/authors/jonathan-guyer

    • https://www.vox.com/2022/1/31/22910635/russia-ukraine-border-crisis-us-nato

    • https://www.wsj.com/articles/russia-moves-more-weaponry-toward-ukraine-keeps-the-west-guessing-11642161605

    • https://www.wsj.com/articles/russia-says-it-sees-little-scope-for-optimism-in-u-s-proposals-on-ukraine-11643290065

    • https://www.reuters.com/world/europe/exclusive-russia-moves-blood-supplies-near-ukraine-adding-us-concern-officials-2022-01-28/

    • https://www.bbc.com/news/world-us-canada-60396947

    • https://www.nytimes.com/live/2022/02/15/world/russia-ukraine-news?partner=slack&smid=sl-share#russia-says-some-troops-are-returning-to-their-bases-but-other-large-scale-military-drills-continue

    • Show all
  • The increasingly complicated Russia-Ukraine crisis explained.pdf.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections