quasar | 8f808bb54b422500304dfc68b87198fc[.]bin

General

Target
8f808bb54b422500304dfc68b87198fc.bin
Size 157KB
Sample230227-b1py4abd43
SHA256 b4b0f1f6e0e6abb53ae6d49bc7f962498d5f55556e1a7e6c0844fbabbd47fc37
MD5 758e7f7fecec060ab3aaf80be2fcdf25
SHA1 5b77429470dffe98691b2bb678028893152452f6
SHA512 2d7299ffa3c27f325b035a9cec32ca35bcfc5c30b9a1542b51a071c606e331a8d4b3a2609304be3c55cd247d2a1d8f1ab60e57ed1d92e03d86dc7ce4f5890c06
SSDEEP 3072:FvRSJGJbAYnu6kQlD1gv5LyqIk0FZVW5jAGCGOHGBKkV8dibIzpNnBB1c5:JR7JbAt6FlD1gv5yHCtAVGO+FOBTc5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75.exe	family_quasar

File Explorer

8f808bb54b422500304dfc68b87198fc.bin

.zip 157KB
680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75.exe

.exe 439KB

8f808bb54b422500304dfc68b87198fc.bin

SHA256 b4b0f1f6e0e6abb53ae6d49bc7f962498d5f55556e1a7e6c0844fbabbd47fc37
MD5 758e7f7fecec060ab3aaf80be2fcdf25
SHA1 5b77429470dffe98691b2bb678028893152452f6
SHA512 2d7299ffa3c27f325b035a9cec32ca35bcfc5c30b9a1542b51a071c606e331a8d4b3a2609304be3c55cd247d2a1d8f1ab60e57ed1d92e03d86dc7ce4f5890c06
SSDEEP 3072:FvRSJGJbAYnu6kQlD1gv5LyqIk0FZVW5jAGCGOHGBKkV8dibIzpNnBB1c5:JR7JbAt6FlD1gv5yHCtAVGO+FOBTc5
MD5 SHA1 SHA512 SSDEEP

Password

infected

680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75
MD5 8f808bb54b422500304dfc68b87198fc
SHA1 24ebeb615f0bdcaa3980722100d6fc42111b62ec
SHA512 46ce4cde81607819e360b0efc424c4b5602c7515661a88e6a0d66cd9e88dcc68219f0a85200e6c40cc34bcac0e5ab652e6db4b4b1c1b913ad351061dae880e99
SSDEEP 6144:vwLRSjIXAnZQel5w7T4P5Kq+SMv0VGb7bDcllbkuVB8:v/4AZrg7g9zVGkllbko
MD5 SHA1 SHA512 SSDEEP

windows x86

Quasar payload

Password

infected

Minor OS version

Major OS version

Entry point

347518

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing