quasar | 5e58c0004cf6475000ee34ee6d551955e4dc6b9e48ad8323b59aeee44d785a1d | Triage

Sharing

General

Target

5e58c0004cf6475000ee34ee6d551955e4dc6b9e48ad8323b59aeee44d785a1d
Size

2.8MB
MD5

6d605945322714ff6541e15e7af8781e
SHA1

ddc331521890afda3017f334619139557c30b42b
SHA256

5e58c0004cf6475000ee34ee6d551955e4dc6b9e48ad8323b59aeee44d785a1d
SHA512

3670e84b68f1aa201557c6f215e45b05a0155046b75555e3156cae358ab1563bbdca18010bbc6ea45a7f1cebbc36acc75a360cf89e811f54bd1dad968614218c
SSDEEP

49152:6Dr5rsFM1kNNnAQ7rQeWU8B31o9o2s8Ufsza32ehyfTYBDm:6DFsFM1kNNA6ke/8lW9o26Ba

Score

10^/10

rr quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

RR

C2

vpnnid.hopto.org:4783

Mutex

0a9b2eca-732e-4379-8b97-28c68a1d3204

Attributes

encryption_key
C390E62881F25347C39CDE51024A9C687D49675F
install_name
svshost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Update
subdirectory
Intel

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

5e58c0004cf6475000ee34ee6d551955e4dc6b9e48ad8323b59aeee44d785a1d
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ