quasar | 93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33 | Triage

Sharing

General

Target

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
Size

2.8MB
MD5

be30e02cf69f0b7fad05dfc7a641d903
SHA1

dec2042f9e76557f59e80aefcd63465761b4dd61
SHA256

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
SHA512

f318d60d2e598307adbd2a302cd6b7b77516a459f9b10620c0d090bb692c689044917d3d011a85f528c01c0e0d7164b84783edd5691948d1748512018a5a4476
SSDEEP

49152:cx/mZWE3x9nn0c1IYVuTRyjrk88RIP5vEUfl6za32ehyfT0m:cxeZWE3x9n0OIYV4Ryjrk88RI0

Score

10^/10

projecthydro quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

ProjectHydro

C2

192.168.145.131:4782

Mutex

959a4a81-1e0c-4b68-9700-ba2617f02c24

Attributes

encryption_key
5314E4E479660AE215BEB448CBAF17EDF374B00B
install_name
vc_redist.x64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
VC redistributable install
subdirectory
vc_redist

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

93ea8d17361393ee2f30e4f742db7437834bab65a9ec407454ac15c5a9811c33
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ