quasar | eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e

General

Target
TangoGen.rar
Size 43.6MB
Sample240420-mflaysec84
SHA256 eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e
MD5 58499bbb694ff3a09362d57e35c660c7
SHA1 8fb1d6c6ff24b9710e78fddce0a3ed20201ccf96
SHA512 bb60444d0c0e91759bc6737a79d1cdb1e678b853fefc0e254a30d3455dcbd4c929847272e2a8f8ef779b6991f1aed44691a10a772c9920dca2a2298fb9a22b89
SSDEEP 786432:vBD907AA6x8fc79JOuWYdlWp7vzi9DzsOfRuCgIyM25jtJwiS7Sh7IbaHuFJ9W:ZD906GW9JOufd99DwSRu/z1avJ9W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

6.tcp.ngrok.io:16799

Mutex

0c20af10-1b0a-4d0e-bbca-3718ee39e827

Attributes

encryption_key
284202D1B7ED732612BB54048953C4453A2549F9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
System32
subdirectory
SubDir

Targets

- Target
  TangoGen.rar
- Size 43.6MB
- SHA256 eb6f8f2a7f814d765640c5e6422921576383c85183677c8c1328f846bda5906e
- MD5 58499bbb694ff3a09362d57e35c660c7
- SHA1 8fb1d6c6ff24b9710e78fddce0a3ed20201ccf96
- SHA512 bb60444d0c0e91759bc6737a79d1cdb1e678b853fefc0e254a30d3455dcbd4c929847272e2a8f8ef779b6991f1aed44691a10a772c9920dca2a2298fb9a22b89
- SSDEEP 786432:vBD907AA6x8fc79JOuWYdlWp7vzi9DzsOfRuCgIyM25jtJwiS7Sh7IbaHuFJ9W:ZD906GW9JOufd99DwSRu/z1avJ9W
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1
- Target
  TangoGen/TangoGenV1.3.EXE
- Size 52.0MB
- SHA256 0e01eb02101b4aa05e0484ac9caebb77a7ecda7a36263aac8a32225fa2a8d38a
- MD5 e9150812ffb2317a7ff1a2491a392ade
- SHA1 6b929ee7d7555604ec71d2463b6c1602aaf38b75
- SHA512 7a7a5c6c29848e5a2f1c12753c6bf9900937b99fd5e07cfb6fc6793216361bc7962fbd0a2b29448bae1c028ab93c11640f176cf5d3897a64973dd954ff417914
- SSDEEP 1572864:CxLPRJ/aHOlj/wZuj/hzJHW2ldP2dUOpfa4X62AC:CH2Mhzn+dUSh
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar office04 persistence pyinstaller spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral2
- Target
  TangoGen/assets.dll
- Size 5.1MB
- SHA256 7f93fef11819a9f4b8edd342a1c2d3dbab25698ed75f9713ee1167fa2f852331
- MD5 773b3b72481fd8ef9b62b5ef0fe8040a
- SHA1 a42cbc7aab88689e834c158b24af8722586cf1b4
- SHA512 db7d29100060afc909cbf20bcd6d9c02fc0b29d8ee32606e2d6cf18270484f2b46853cda0b495a85cc7a2e3ae4536030a25216f101dceabf2f972e3375208c38
- SSDEEP 768:+UI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUI7yUIn:3
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral3
- Target
  TangoGen/instructions.txt
- Size 283B
- SHA256 24c17fd24aaf02a5f7ac3f6c94c26aac66b5666fc017339d62d82816c41010ec
- MD5 d1f4e26ecd7fbecbdc4f78f84ed4fb3e
- SHA1 ed45ea4e43b929e3fabaed771d678e4ede784e34
- SHA512 c179bd6dc3525ef97a0db494e6796dcb0f4bf00590b3010f90d02051bf9f18a96e80b52890ad2aedfd9d3f9cc4dc9a129caff2d03f25c5166fd660e1124a34a8
- MD5 SHA1 SHA512
Score

1^/10
behavioral4
- Target
  TangoGen/license.txt
- Size 6KB
- SHA256 a19d58aaab15c4d0019e569d1c073d1b5286fdd37dbeee7a58a7d1ae76045ae1
- MD5 0b09566254b011d989decf0e23a902eb
- SHA1 3ae5cd6be73daf418b8deee9c865cf78225838c9
- SHA512 4e22e58f925879306261e5993039e1d84d87f8fecc0f9fdad534da55b6fd22be77e622a4077d8d521f7734e5535f66853d581155987e2f3607e2d386938c218b
- SSDEEP 192:uEwjuKsgA4+XYdXjA+okS63vZBCSUziJm:eNs8+QRVxBRU1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5