quasar | ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058

Sharing

Copy URL Twitter E-mail

General

Target
ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058
Size 3.3MB
Sample240408-c7qpmsef38
SHA256 ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058
MD5 890b0b482a25c673242d2ab7d5171d61
SHA1 7102436d6ad90123bbbb8df13a0aa3c0cd310cad
SHA512 937421bf50f9c5203a5661b276e97ba0ff07f1b8de95b6ec2b72f3cc6cfbd683665268b707783657b923df60c2127252b97be5fe5c0ff5f73bcb8259b7c9d9fa
SSDEEP 49152:Pvkt62XlaSFNWPjljiFa2RoUYIvLSkh0arNGoGdvTHHB72eh2NT81:Pv462XlaSFNWPjljiFXRoUYITBhep
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

randoms quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

randoms

192.168.50.97:4782

Mutex

d1132518-98da-4fb2-9846-de05b9c45c57

Attributes

encryption_key
CB8080F6DCDDE3CF3D0207D31F2E0D22CCB3D9ED
install_name
Injection.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows.exe
subdirectory
SubDir

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058

File Explorer

ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058

.exe 3.3MB

ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058
MD5 890b0b482a25c673242d2ab7d5171d61
SHA1 7102436d6ad90123bbbb8df13a0aa3c0cd310cad
SHA512 937421bf50f9c5203a5661b276e97ba0ff07f1b8de95b6ec2b72f3cc6cfbd683665268b707783657b923df60c2127252b97be5fe5c0ff5f73bcb8259b7c9d9fa
SSDEEP 49152:Pvkt62XlaSFNWPjljiFa2RoUYIvLSkh0arNGoGdvTHHB72eh2NT81:Pv462XlaSFNWPjljiFXRoUYITBhep
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables containing common artifacts observed in infostealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3269550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ee744afa00674c978780c9a27da3245d646037b9fa8b76828a021b750cc92058

mscoree

dotnet