quasar | rat[.]exe | Triage

Sharing

General

Target

rat.exe
Size

3.1MB
MD5

fc85c7753f60a7be64282dc768d82ddb
SHA1

89402d107e7b9060890ea3a6a77eb63792be50f9
SHA256

7ed672be4c63c1e9c726843a76a8ba96af26c242742b9feb69e51ac3b681cf6f
SHA512

08acfd1366046675328e00ec5a8e4133879ffefeabfdd6a0bbc3db2a71829d7c1915b166f984b63543eb386f2091ba3c4a5f37556dbfa68b35634365b8084dd1
SSDEEP

49152:avzlL26AaNeWgPhlmVqvMQ7XSKa9/TBxZ/oGdz2THHB72eh2NT:avpL26AaNeWgPhlmVqkQ7XSKY/h

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

nayef.ddns.net:4782

Mutex

d4cc8fd4-c53a-41d0-8597-9c4d66a686e4

Attributes

encryption_key
207983DF7933102376491C87A7AF844DA0465E51
install_name
Windows Wireless LAN.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Wireless LAN
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

Files

rat.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ