quasar | 03b3994449556eb9937fb8baa0ffbffa | Triage

Sharing

General

Target

03b3994449556eb9937fb8baa0ffbffa
Size

407KB
MD5

03b3994449556eb9937fb8baa0ffbffa
SHA1

e08d0eaf2ffec67b73b2771ac82fa6ee07c2f6ae
SHA256

3e66131bb29804bf3fd4a1550c916a767d35729f73ba0cd77b904872c9bebe95
SHA512

516840a95304dc4b77dcf519f299b5960958b1497917d8e065a5fe373ff5b31611938b9906003216eee8b8a4348fa12e2688c6662cabd67b246d60e811560664
SSDEEP

6144:0TEgdc0YNX7IxUpGREWUA47qbOkQgaezUUNxnsbC733OcTR3k:0TEgdfYWxUj5wjz3nRucdk

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

forthacks.hopto.org:4782

Mutex

1abe5811-fa99-4884-a104-b9abb6bc0fc6

Attributes

encryption_key
FF1B2D5C6F8DB53C50B257D39B9CB924BE482CB1
install_name
directx.exe
log_directory
updatelog
reconnect_delay
3000
startup_key
Steam
subdirectory
directx

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03b3994449556eb9937fb8baa0ffbffa

Files

03b3994449556eb9937fb8baa0ffbffa
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 403KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ