quasar | a7ed0353055a0a7955126c99da4e5db041d3314e00b074084a688a6e95c45ac0 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a7ed0353055a0a7955126c99da4e5db041d3314e00b074084a688a6e95c45ac0
Size

307KB
MD5

a27e4a89ad0c215c9953193923ea85f4
SHA1

5ea8e3dcec7ea938e7d8e59a70f5940025d23186
SHA256

a7ed0353055a0a7955126c99da4e5db041d3314e00b074084a688a6e95c45ac0
SHA512

7701a3fc98418768d7d6264f0c7702470b0f195118ca84ed69c8c332d9dd42358435db5a87d7527950077c9a3ce6f1d7f98564d2f36c3228eb573556586dda83
SSDEEP

6144:Bshd7eDcqk0G1Ypil1TQxqhzu4nkhdVwbjJ1ybkYWZrrpT22rkOXrU:VDcT1tY4Idc1ybkXZhT2kbU

Score

10^/10

svhost quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

svhost

C2

213.166.70.161:4382

Mutex

yPY6kNAgcPTU0BEbwL

Attributes

encryption_key
x6Rzd5QkYEdxkwcdu3nG
install_name
system32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
system
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

a7ed0353055a0a7955126c99da4e5db041d3314e00b074084a688a6e95c45ac0
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ