quasar | SynapseX[.]Revamped[.]V1[.]5[.]rar

Resubmissions

28/05/2024, 02:35

240528-c3cl8acg6510

28/05/2024, 02:34

240528-c2ncbsbe8y10

Sharing

Copy URL Twitter E-mail

General

Target
SynapseX.Revamped.V1.5.rar
Size 6.9MB
Sample240528-c2ncbsbe8y
SHA256 8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011
MD5 358e3fc465a47e440775cd04fe9e9650
SHA1 c0dea173ba12149b325de5831c2e08d8c3ff7b21
SHA512 1a8dad583487280053ec13a088f02f54177f2c14318d9edfc60121884e6bda8e06979c47fa2e9100db21ecedcb30431a1842c2a6ef3c69f20b703ea07865348f
SSDEEP 196608:SGOV4gKBR19F8lsJ7WJ+ZVNXARR+n9fmYclvlcf:SB4LFXKsJ7QmVNXARkVwl9cf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

windows update quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

skbidiooiilet-31205.portmap.host:31205

Mutex

b2f09b33-2e5b-4ffa-afbf-3f1aaed274a6

Attributes

encryption_key
6F721445F7E0B1CF58980D84A9D49F4458D4EFD9
install_name
Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
WindowsUpdate
subdirectory
Windows Update

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/SynapseX Revamped V1.5/SynapseXBootstrapper.exe	family_quasar

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SynapseX Revamped V1.5/SynapseXBootstrapper.exe
unpack001/SynapseX Revamped V1.5/bin/SynapseInjector.dll

File Explorer

SynapseX.Revamped.V1.5.rar

.rar 6.9MB
SynapseX Revamped V1.5/SynapseXBootstrapper.exe

.exe 3.1MB
SynapseX Revamped V1.5/bin/SynapseInjector.dll

.dll 6.0MB

SynapseX.Revamped.V1.5.rar

SHA256 8739b236fb674c2c3516bc43ecf4b6583ea22ca0d4b2fe417b6223d654d52011
MD5 358e3fc465a47e440775cd04fe9e9650
SHA1 c0dea173ba12149b325de5831c2e08d8c3ff7b21
SHA512 1a8dad583487280053ec13a088f02f54177f2c14318d9edfc60121884e6bda8e06979c47fa2e9100db21ecedcb30431a1842c2a6ef3c69f20b703ea07865348f
SSDEEP 196608:SGOV4gKBR19F8lsJ7WJ+ZVNXARR+n9fmYclvlcf:SB4LFXKsJ7QmVNXARkVwl9cf
MD5 SHA1 SHA512 SSDEEP

SynapseX Revamped V1.5/SynapseXBootstrapper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336
MD5 9434a1822088cedbce057d280c235864
SHA1 c09173a18e5ae2d9d38bd4d3d196adf1423f924e
SHA512 7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632
SSDEEP 49152:PvnI22SsaNYfdPBldt698dBcjHHeJ/uBx3ioGdyTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjH4/X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3269662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SynapseX Revamped V1.5/bin/SynapseInjector.dll

SHA256 39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e
MD5 9b248dfff1d2b73fd639324741fe2e08
SHA1 e82684cd6858a6712eff69ace1707b3bcd464105
SHA512 56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c
SSDEEP 98304:whgYUp+QvBY2uccY07B1nG9CHvaxFNErtcKXc17TEBT0VBTFX3NwwJqOft:w2j8YCRGEP0iOvuT0FXKwt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15876096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

Size

510KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

Size

275KB

Virtual Size

946KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

60KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.edata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.exdata

Size

Virtual Size

7.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.loadcon

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.boot

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.init

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

32B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ

SynapseX.Revamped.V1.5.rar

SynapseX Revamped V1.5/SynapseXBootstrapper.exe

mscoree

dotnet

SynapseX Revamped V1.5/bin/SynapseInjector.dll

generic