quasar | cb1b47d4d77eb1f26a10c130694871af6a00c0f7e83bb65e1d225844a644d30f

General

Target

cb1b47d4d77eb1f26a10c130694871af6a00c0f7e83bb65e1d225844a644d30f
Size

133KB
Sample

221002-zfc1ssbcdj
MD5

3f1701eae7d5b6b1534fc4749ea5f1b3
SHA1

9f1b6c5ef68123d23175c7736be56f9428419be5
SHA256

cb1b47d4d77eb1f26a10c130694871af6a00c0f7e83bb65e1d225844a644d30f
SHA512

9c329624d0b6b35a5b6b337586a532f239b73031d8ad2d7be344c1a5d44d4b12258ddb621b51116a7a38b2668534e950ae897186cac358a73a7fe186f8feee67
SSDEEP

3072:mBcJizORf+uJZIwiVFwz0rjnNdJ4x/SZKS2Rl1GMTRGG:FiGZX4VrjR4x/VSeGMTRG

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

fud

C2

45.15.156.7:48638

Attributes

auth_value
da2faefdcf53c9d85fcbb82d0cbf4876

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

80.76.51.137:4782

Mutex

9bf8fb2c-fccb-44eb-adec-7065899a9e07

Attributes

encryption_key
4F7D628B38CA922D6BB190220B885CBE1984E30E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  cb1b47d4d77eb1f26a10c130694871af6a00c0f7e83bb65e1d225844a644d30f
- Size
  
  133KB
- MD5
  
  3f1701eae7d5b6b1534fc4749ea5f1b3
- SHA1
  
  9f1b6c5ef68123d23175c7736be56f9428419be5
- SHA256
  
  cb1b47d4d77eb1f26a10c130694871af6a00c0f7e83bb65e1d225844a644d30f
- SHA512
  
  9c329624d0b6b35a5b6b337586a532f239b73031d8ad2d7be344c1a5d44d4b12258ddb621b51116a7a38b2668534e950ae897186cac358a73a7fe186f8feee67
- SSDEEP
  
  3072:mBcJizORf+uJZIwiVFwz0rjnNdJ4x/SZKS2Rl1GMTRGG:FiGZX4VrjR4x/VSeGMTRG
Score

10^/10

quasar redline smokeloader fud office04 backdoor discovery infostealer persistence spyware stealer trojan
- Detects Smokeloader packer
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1