quasar | 90e6021564d45d877555674a8e44ea83fdac8d4c58d50cec72f068c608c18aab

General

Target

90e6021564d45d877555674a8e44ea83fdac8d4c58d50cec72f068c608c18aab
Size

3.1MB
MD5

cb9d96470528dad492231fcdf0925086
SHA1

c9c556cabeaa09e24d999fc5d597999a5e0c164d
SHA256

90e6021564d45d877555674a8e44ea83fdac8d4c58d50cec72f068c608c18aab
SHA512

121fd90e09ff59ad056bc15c8c9b90db9298c8a9606a61d20153031bd083ea9df51b8d8c6c34cfb61e8cd6e385bdbe426eeb4c6a85ca87ddea06c7bb3af15a3c
SSDEEP

49152:PvRuf2NUaNmwzPWlvdaKM7ZxTwcQJ+3lmZIXoG/PTHHB72eh2NT:Pvsf2NUaNmwzPWlvdaB7ZxTw1J+3z

Score

10^/10

slave quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:38899

uk2.localto.net:38899:38899

Mutex

276d9dc6-b19c-4958-8ac3-89586bd3b515

Attributes

encryption_key
ABCF70C37D1A79A01712038122D1532DF20DF72A
install_name
Client.exe
log_directory
Error Logs
reconnect_delay
3000
startup_key
WOS64
subdirectory
Windows

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 1 IoCs

Processes:

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Quasar family
quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

sample family_quasar

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
90e6021564d45d877555674a8e44ea83fdac8d4c58d50cec72f068c608c18aab

Files

90e6021564d45d877555674a8e44ea83fdac8d4c58d50cec72f068c608c18aab
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 3.1MB - Virtual size: 3.1MB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 3.1MB - Virtual size: 3.1MB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 12B