quasar | ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862

Sharing

Copy URL Twitter E-mail

General

Target
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
Size 3.1MB
Sample240701-cc95sssfna
SHA256 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
MD5 1633db1ce0d5eae8b246019541b00372
SHA1 00b8f4ede2ca86fd53b3012e4a317318a20dd39b
SHA512 3843b4ad7b2a6d7dd8220f4dd30952a3f6d9918c1391234d3fc2abfcd2adcfd33a6d161a9ad562df661149dedaf5b0589484eb053fdb35c3f41983066e22751a
SSDEEP 49152:rvzlL26AaNeWgPhlmVqvMQ7XSKY9BSPnaMYLowdseTHHB72eh2NT:rvpL26AaNeWgPhlmVqkQ7XSK+oPY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.111:4782

Mutex

1f5e43b0-2e6e-4529-bedf-628650591bdf

Attributes

encryption_key
0FF1E4E83CF341CB74C4BB8B5D7980A41A9AF65B
install_name
DescryptMain.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_GENInfoStealer

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862

File Explorer

ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862

.exe 3.1MB

ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862
MD5 1633db1ce0d5eae8b246019541b00372
SHA1 00b8f4ede2ca86fd53b3012e4a317318a20dd39b
SHA512 3843b4ad7b2a6d7dd8220f4dd30952a3f6d9918c1391234d3fc2abfcd2adcfd33a6d161a9ad562df661149dedaf5b0589484eb053fdb35c3f41983066e22751a
SSDEEP 49152:rvzlL26AaNeWgPhlmVqvMQ7XSKY9BSPnaMYLowdseTHHB72eh2NT:rvpL26AaNeWgPhlmVqkQ7XSK+oPY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Detects executables containing common artifacts observed in infostealers
Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3269662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ba81b05c43bae8ee850ebff1ca399808b4828e5455ad2b2f9e64dd7962c33862

mscoree

dotnet