quasar | c03bcab540749f92aab1c8b5a12237d243d64311a7937ab6b8ce232667f73d67 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c03bcab540749f92aab1c8b5a12237d243d64311a7937ab6b8ce232667f73d67
Size

348KB
MD5

64b9e8fc81331af4aacac926048cff41
SHA1

b3d64e99c3fc6461fc3b8d601afd2a517ae15626
SHA256

c03bcab540749f92aab1c8b5a12237d243d64311a7937ab6b8ce232667f73d67
SHA512

b8f12f9f8b88b4468c424bab92c2497a03fe1b28ff566b83c8577f6554da4400be535665e429e6e3bf8506ece398db1ab8dd45baadcaa371284a92c84c340a8d
SSDEEP

6144:Y2NHXf500Mla2Hr9t2YbXjt66RyoaaB5t6:nd50jqGYCyoaaB/6

Score

10^/10

renew quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Renew

C2

51.12.244.74:3788

Mutex

QSR_MUTEX_37CuFpkEZVT0i5A8iN

Attributes

encryption_key
0S58qdVd5fmnss9zPHsn
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

c03bcab540749f92aab1c8b5a12237d243d64311a7937ab6b8ce232667f73d67
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ