quasar | d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

Sharing

Copy URL Twitter E-mail

General

Target
d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833
Size 3.1MB
Sample240412-cdlhtsca33
SHA256 d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833
MD5 3396e77d0d043554c7f857a1249c75fe
SHA1 d3de2678e85f4ad63e5254782a58a85035aafecc
SHA512 3128c03a0465d03127cf6df186533993e2337dce8ca821d8dbcaecd08c7ff7a6d2646de150b7afbe20641e4eb08104342813dfd2fe50346c8b47d40deedc67a4
SSDEEP 49152:WvnG42pda6D+/PjlLOlg6yQipV7tjMpETOk/FLoGd7RTHHB72eh2NT:WvG42pda6D+/PjlLOlZyQipVhj9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

10.10.8.36:4782
0.tcp.eu.ngrok.io:19992
tcp://5.tcp.eu.ngrok.io:10477

Mutex

570f8f63-dc8c-471b-b7f5-710ac819d722

Attributes

encryption_key
BB0B2DE4F1126E98797D1ABADF2CCEC47E72B5FD
install_name
Client.exe
log_directory
Logs
reconnect_delay
150
startup_key
Platonus
subdirectory
SubDir

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

File Explorer

d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

.exe 3.1MB

d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833
MD5 3396e77d0d043554c7f857a1249c75fe
SHA1 d3de2678e85f4ad63e5254782a58a85035aafecc
SHA512 3128c03a0465d03127cf6df186533993e2337dce8ca821d8dbcaecd08c7ff7a6d2646de150b7afbe20641e4eb08104342813dfd2fe50346c8b47d40deedc67a4
SSDEEP 49152:WvnG42pda6D+/PjlLOlg6yQipV7tjMpETOk/FLoGd7RTHHB72eh2NT:WvG42pda6D+/PjlLOlZyQipVhj9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables containing common artifacts observed in infostealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3269726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d543c38fb2f5f8e687d97cff1878a2e4e4ada846c3fb3df5e43e6f189da29833

mscoree

dotnet