quasar | Tiktok-Share-Bot-By-Denmark[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Tiktok-Share-Bot-By-Denmark.zip
Size 11.6MB
Sample240409-xfgb4sec85
SHA256 ef7a777d354433cc1398552311446bbc0be13e34407ca6fd7a67e4c750e76183
MD5 54bbebf31363300459fd1660bf5493b7
SHA1 c8ff555abf4a179a9bcb32c0e2d4fb502061bbbe
SHA512 faeacb7860aec90cee53cb975d98bb6a1f01392c2a4914c27e6c259b05728def6352a9d2c82ff01d68056bd50df17a5b2cad7590725a127131844b0458a1b676
SSDEEP 196608:A7gyk60n8baTVsxzDJmXCoy86Q4/+VfB0g5hNF1SqAk3bfQzMzh:A7g/8GZsuSoy86QktOSqLM2h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar sectoprat

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def
static1/unpack001/libGLESV2.lib	disable_win_def

Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
sample	family_quasar
static1/unpack001/libGLESV2.lib	family_quasar

SectopRAT payload 2 IoCs

resource	yara_rule
sample	family_sectoprat
static1/unpack001/libGLESV2.lib	family_sectoprat

Sectoprat family
sectoprat

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Tiktok Share Bot byDenmark.exe
unpack001/data32.bin
unpack001/libGLESV2.lib
unpack001/libcef.bin

File Explorer

Tiktok-Share-Bot-By-Denmark.zip

.zip 11.6MB
Read.txt

287B
Tiktok Share Bot byDenmark.exe

.exe 774KB
data32.bin

.exe 238KB
libGLESV2.lib

.exe 10.4MB
libcef.bin

.exe 211KB

Tiktok-Share-Bot-By-Denmark.zip

SHA256 ef7a777d354433cc1398552311446bbc0be13e34407ca6fd7a67e4c750e76183
MD5 54bbebf31363300459fd1660bf5493b7
SHA1 c8ff555abf4a179a9bcb32c0e2d4fb502061bbbe
SHA512 faeacb7860aec90cee53cb975d98bb6a1f01392c2a4914c27e6c259b05728def6352a9d2c82ff01d68056bd50df17a5b2cad7590725a127131844b0458a1b676
SSDEEP 196608:A7gyk60n8baTVsxzDJmXCoy86Q4/+VfB0g5hNF1SqAk3bfQzMzh:A7g/8GZsuSoy86QktOSqLM2h
MD5 SHA1 SHA512 SSDEEP

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Quasar payload
SectopRAT payload

Tiktok Share Bot byDenmark.exe

IMPHASH a283dafca83c0a2a8ece9859011b15c6
SHA256 40278019afe364e36be0e88470cb626a5aba0f78c23b171b4eb30e80db159763
MD5 4e27884494531416bd41504c7e0ba4ac
SHA1 f806c283c32bb43380c2636e2382a70484ea4b89
SHA512 e2e5c8be79d1e0ddb70d667e6fd79023e9e34306f9a987d661aa1e9d46c5c2fe574ec6d52f871483455f5be1f722d76b396a9121450d9e7c824d4648bbc445ce
SSDEEP 24576:ML2wAwspzLMrL8vuJB98x1i09m6qfsTtUzF/B:1wAwspzLMrxB98x1i09vJUzJB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Quasar payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

249551

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\w\opener\Release2\Console-Opener.pdb

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle ReadConsoleW FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RaiseException GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW SetStdHandle GetFileSizeEx SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

version

VerQueryValueW

Name

.text

Size

601KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

data32.bin

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 f67daf4bf2ad0e774bbd53f243e66806397036e5fde694f3856b27bc0463c0a3
MD5 4e6a7ee0e286ab61d36c26bd38996821
SHA1 820674b4c75290f8f667764bfb474ca8c1242732
SHA512 f9d99d960afce980421e654d1d541c1fdb81252615c48eed5c4a5c962cb20123d06dbdf383a37a476aa41e4ffabca30e95a8735739c35f66efbaa1dee8a9ba8a
SSDEEP 3072:6sGTNBBPt3lBtx5ebLDCc0p00JakwEn0ZtAq0nHHdNwooe+6t3ieCx9UWPrcFw+z:ID5t3lBrGdkwFi3HHdN1Zt9CxVgeH
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Quasar payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103796

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

libGLESV2.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 54c1dc44cd458da7ec96343973fa7f350df27517715f41483f9cab748d3a9203
MD5 621c28cd39d9d6f9a3377b8da8a8849b
SHA1 5a025ed5f5baae77496e27fb2996fcb22d67ed40
SHA512 b5600b871ac950ec10d7bd0c38bb242a9921b1bccd2dacaa709471475a4c410eb2b43b693e2c18db40349f5c8e15b2c0ee93dde4eb3cbce2f47db880fe48033f
SSDEEP 196608:4nIMYy23CPc/V0VjfJcPE8Yw6QodKh7Ls85JxhVgE+uBd1ub:4nIRyEN08s8Yw6Qg1IgEzE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Quasar payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10889614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

libcef.bin

IMPHASH b66f87cf58494faf62e606c7906acafe
SHA256 8baa5811836c0b4a64810f6a7d6e1d31d7f80350c69643dc9594f58fd0233a7b
MD5 59238144771807b1cbc407b250d6b2c3
SHA1 6c9f87cca7e857e888cb19ea45cf82d2e2d29695
SHA512 cf2f8b84526ae8a1445a2d8a2b9099b164f80a7b7290f68058583b0b235395d749ad0b726c4e36d5e901c18d6946fd9b0dd76c20016b65dc7a3977f68ee4a220
SSDEEP 3072:CFITGLr+kmeUE2+YA8zuxD1gb/uVVohUFVEovODl9ply5nk/7K1bjT5h3qs:CbLUEkAtvaumhUXvwl9P62
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Quasar payload
SectopRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar CreateFileW GetCurrentThreadId WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo CloseHandle QueryPerformanceCounter GetStringTypeW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetTimeZoneInformation GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

winhttp

WinHttpReceiveResponse

Tiktok-Share-Bot-By-Denmark.zip

Read.txt

Tiktok Share Bot byDenmark.exe

kernel32

version

generic

data32.bin

kernel32

generic

libGLESV2.lib

mscoree

dotnet

libcef.bin

kernel32

winhttp

generic