quasar | Bloxflip Predictor[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Bloxflip Predictor.zip
Size

1.2MB
MD5

5929c0351825987af01f74082a3598bc
SHA1

b93e9e398a212df81d9c9f74d0005fb520674683
SHA256

996f89601524fbc64d50f4f069fe56dccc9388a67ace1ecf84c37ac4017f0acd
SHA512

58b63e9ef0d02f202acc8e0aa48f3127655e41feb09234c8f394e38c605b2d1f1ce63445ecad6bc4859c3e1a67b72bdbff14c8e2a1d8da6192f6bd4a4f14684c
SSDEEP

24576:yXC3U8RITQpnJzejKnPM1d9OprRUIT+ByFd8Xdw239fqEXE5zZlr0j:yXYU7SnJzc1d7ITSqkV3BBXmtCj

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.68.64:4782

Mutex

75b36097-b407-4e88-ad84-e1aee7ab7912

Attributes

encryption_key
E66E6C0A7C3E03AB7FD6F38667C7583F9964D61D
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/Predictor.exe	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Predictor.exe

Files

Bloxflip Predictor.zip
.zip
Predictor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
READ FIRST.txt