quasar | 3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def

General

Target

3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
Size

133KB
Sample

221002-yqy6caabbl
MD5

dc8fc2af8ee44281b06c649e93556e1d
SHA1

b34f8049d382830170e846e5ce3184974e619d9b
SHA256

3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
SHA512

a29e0adb7a1f81adb205cc75f3c90cbe0d7bcad88b1cb78784b24e12129c3bd1ac1873d8db69465a9fc372c0bd39c3a1bcc9b3f7a382c5f3c52bae4744227786
SSDEEP

3072:anqHM7ORN5z60H+/6GKLoehSVVq+5ixgyTG:HZokZ7YZ5iCyT

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

fud

C2

45.15.156.7:48638

Attributes

auth_value
da2faefdcf53c9d85fcbb82d0cbf4876

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

80.76.51.137:4782

Mutex

9bf8fb2c-fccb-44eb-adec-7065899a9e07

Attributes

encryption_key
4F7D628B38CA922D6BB190220B885CBE1984E30E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
- Size
  
  133KB
- MD5
  
  dc8fc2af8ee44281b06c649e93556e1d
- SHA1
  
  b34f8049d382830170e846e5ce3184974e619d9b
- SHA256
  
  3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
- SHA512
  
  a29e0adb7a1f81adb205cc75f3c90cbe0d7bcad88b1cb78784b24e12129c3bd1ac1873d8db69465a9fc372c0bd39c3a1bcc9b3f7a382c5f3c52bae4744227786
- SSDEEP
  
  3072:anqHM7ORN5z60H+/6GKLoehSVVq+5ixgyTG:HZokZ7YZ5iCyT
Score

10^/10

quasar redline smokeloader fud office04 backdoor discovery infostealer persistence spyware stealer trojan
- Detects Smokeloader packer
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1