quasar | BuiltSub[.]zip

General

Target
BuiltSub.zip
Size 1.2MB
Sample240724-xbsvcathkd
SHA256 905e1130c16455e6bd8bd950d2ecc825f211636a3114390b7db17204afbbdd30
MD5 c5acd4d9700a3ca64d9db7c415f191ad
SHA1 133bdfa8d60e5c3d874427f702d21a8518f44023
SHA512 544c06aeb926c243ab858c1c45b0cf2056d329119ac50b333da8b10c0d06beb61f36868fe2ecc6eecd37e1ec8b901347be8fba083e6672277f7f50617094995e
SSDEEP 24576:eTiFmBmKKjFOkHQz/uiF1nO4wkri1It13/DNn6tB+YEMPMMxf94C:e5cK2kkwz/uiNwkGA13/h6trEMbVqC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

subeer quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Subeer

C2

192.168.197.45:4782

Mutex

ad8dba7f-06db-4d0a-9afc-74dfd02d5347

Attributes

encryption_key
B31DD910CCE569E87A1C1C1F365FCA4C48E5D4AE
install_name
Roblox.exe
log_directory
Logs
reconnect_delay
500
startup_key
CefSharp.BrowserSubprocess
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/BuiltSub.exe	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BuiltSub.exe

File Explorer

BuiltSub.zip

.zip 1.2MB
BuiltSub.exe

.exe 3.1MB

BuiltSub.zip

SHA256 905e1130c16455e6bd8bd950d2ecc825f211636a3114390b7db17204afbbdd30
MD5 c5acd4d9700a3ca64d9db7c415f191ad
SHA1 133bdfa8d60e5c3d874427f702d21a8518f44023
SHA512 544c06aeb926c243ab858c1c45b0cf2056d329119ac50b333da8b10c0d06beb61f36868fe2ecc6eecd37e1ec8b901347be8fba083e6672277f7f50617094995e
SSDEEP 24576:eTiFmBmKKjFOkHQz/uiF1nO4wkri1It13/DNn6tB+YEMPMMxf94C:e5cK2kkwz/uiNwkGA13/h6trEMbVqC
MD5 SHA1 SHA512 SSDEEP

BuiltSub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f3bbdd5a2cc7e3e237f479c1fda8763b93cd5258531ae5c132b7aed4bdfe8385
MD5 6c83847c38f74f6cde80d1517f95f7d0
SHA1 9709445d7d81886840accda30fbafb8aa4a6f384
SHA512 ed20965552957439459a04af0e06317ae620f459d8e7d58af46b4c6ae5ac87328228caa13b80aa99c3da24c11ed82b483c69588297141395048e24d26b02d36c
SSDEEP 49152:rvcI22SsaNYfdPBldt698dBcjHmbLfmzT5oGddwTHHB72eh2NT:rvR22SsaNYfdPBldt6+dBcjHmbLy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3269630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

BuiltSub.zip

BuiltSub.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

BuiltSub.zip

BuiltSub.exe

mscoree

dotnet