quasar | client[.]zip

General

Target
client.zip
Size 1.2MB
Sample240510-wt7ksadf55
SHA256 6b4950508f491507d0c137aaab8c290dac4bf0a2e134b34f47f4eec4155a1bae
MD5 0cc760b657bb0ee0da4c2d91a524c2c9
SHA1 b46917d25595bd85e216144982e4ee2eb8391a3f
SHA512 c460052118e8355443440458f750eedb232a3a7eeded5b26238ad8c8aff65a9eac5c8efd2fcf57d870d2ea34b91225957b91c44ecc5e73a86b8e365a06f516c6
SSDEEP 24576:/yWXmlwiwj1IN6W7Y3pOSW/DWZRYbF51fSTC41B0a4ERM5gXF+KAyS:/MTwhIN6WScNiZebFXfE6a4ERM5a+KAx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.50.244:4782

Mutex

8c0dd4a8-9378-4bb0-a8b0-01c7a7abc4a0

Attributes

encryption_key
25C9945CAA6B7DC1F00936AF44864E2B40484EAE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Client Startup
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/Client-built.exe	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Client-built.exe

File Explorer

client.zip

.zip 1.2MB
Client-built.exe

.exe 3.1MB

client.zip

SHA256 6b4950508f491507d0c137aaab8c290dac4bf0a2e134b34f47f4eec4155a1bae
MD5 0cc760b657bb0ee0da4c2d91a524c2c9
SHA1 b46917d25595bd85e216144982e4ee2eb8391a3f
SHA512 c460052118e8355443440458f750eedb232a3a7eeded5b26238ad8c8aff65a9eac5c8efd2fcf57d870d2ea34b91225957b91c44ecc5e73a86b8e365a06f516c6
SSDEEP 24576:/yWXmlwiwj1IN6W7Y3pOSW/DWZRYbF51fSTC41B0a4ERM5gXF+KAyS:/MTwhIN6WScNiZebFXfE6a4ERM5a+KAx
MD5 SHA1 SHA512 SSDEEP

Client-built.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a0b392d3c49dc9b3b763b6ad04984877f6ab7652a09630faa5b7058a19c81a5f
MD5 a5aa53a0c804e4ca657a4f27cd1c02c0
SHA1 0ee279c8084ef985c4525b5d2f494c28c5795e8e
SHA512 cf59cb9797901a7a2cf447d2bb468996728a8c135e40978c545696e076f82b3faeae47681afb05498df856042d253cc16800d1dba57f89594428f2bcbe5326f3
SSDEEP 49152:evkt62XlaSFNWPjljiFa2RoUYIbHRJ6hbR3LoGduKTHHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIbHRJ6D
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3269598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

client.zip

Client-built.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

client.zip

Client-built.exe

mscoree

dotnet