quasar | 1244-59-0x0000000000400000-0x000000000045E000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1244-59-0x0000000000400000-0x000000000045E000-memory.dmp
Size

376KB
MD5

78d913a495bf7ae6b6da8b911161d38b
SHA1

23f9e74560df1fc1a7f1c6072c4e9d275f177934
SHA256

74a4d6b4c54d9dc88d0dd7c1f00c1aa2bd8c75d76429d0a1fb770848c3a7dcfe
SHA512

bf24efffde527b4677dec10c8698b1eba3dff5eec1f06993973a8437c89c623dd061904b63f3314c8d0cd2fa3b2d53e7308490c56cc160d8924d3bfa58344753
SSDEEP

6144:oscOAH95gFbNViZOBUrR7B9pby1/tINLR/lhlM63yYZy:VIkTY0VI9hlhlMTYZy

Score

10^/10

server quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

server

C2

qassar22.ddns.net:2032

Mutex

QSR_MUTEX_abYR98d6vBWgpLPkBE

Attributes

encryption_key
ceVNim0WaC4ae8e2EeFe
install_name
Update service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Updatservice.exe
subdirectory
microsofte

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

1244-59-0x0000000000400000-0x000000000045E000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ