quasar | 8fc4a62391febd50587166983e84c5c0_NeikiAnalytics[.]exe | Triage

Sharing

General

Target

8fc4a62391febd50587166983e84c5c0_NeikiAnalytics.exe
Size

349KB
MD5

8fc4a62391febd50587166983e84c5c0
SHA1

a4cbaae76ff7ca480ef87fd7aa1f46e830e64621
SHA256

a1707b6c2aafaa7f62d8f69fbde724faf47ed39551fabd757b9e16026f4380b3
SHA512

7adc8f3854f7e74970b36ce7e622f20aac14f425dacffee11bcddecd2f099a29552c7c52ed9d0101c9a2b66094305c7ae4acda8474eb3c0a80095e72a49dba18
SSDEEP

6144:VK2J10qdSlEc39HGwpa75KH22bJzhDMwFVNx09:VKFt85KH2AIw1x09

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

india-chess.gl.at.ply.gg:64671

Mutex

QSR_MUTEX_ynYCl8Ngv780FxdqkR

Attributes

encryption_key
mfHLMVa4dcqQBTXno0uj
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar family
quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

sample family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
8fc4a62391febd50587166983e84c5c0_NeikiAnalytics.exe

Files

8fc4a62391febd50587166983e84c5c0_NeikiAnalytics.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ