e0bc13d8be65d524a6e7f23a0764b2ae.bin
- SHA256 fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10
Behavioral task
behavioral1
Sample
DLL/kksvv.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
DLL/kksvv.dll
Resource
win10v2004-20240729-en
Behavioral task
behavioral3
Sample
DLL/msvcp140.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
DLL/msvcp140.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
DLL/vcruntime.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
DLL/vcruntime.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
RedEngine.exe
Resource
win7-20240704-en
quasar
1.4.0
TRAINING
185.241.208.185:16145
22073971-8d9a-4364-9916-abbb09ac9d8b
7A9A8376440E3257DB2B54403642F366A5FBE14A
Starter Module.exe
Logs
3000
Starter Module
Modules
| resource | yara_rule |
|---|---|
| static1/unpack001/RedEngine.exe | family_quasar |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/RedEngine.exe |
Jul 26, 2024
Apr 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=199, id=1, productName=Unmarked objects,
count=5, id=257, version=28619,
count=8, id=260, version=28619,
count=4, id=259, version=28619,
count=145, id=261, version=28619,
count=1, id=256, version=28619,
count=1, id=255, version=28619,
count=1, id=258, version=28619,
Jul 26, 2024
Apr 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=199, id=1, productName=Unmarked objects,
count=5, id=257, version=28619,
count=8, id=260, version=28619,
count=4, id=259, version=28619,
count=145, id=261, version=28619,
count=1, id=256, version=28619,
count=1, id=255, version=28619,
count=1, id=258, version=28619,
Jul 26, 2024
Apr 19, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=199, id=1, productName=Unmarked objects,
count=5, id=257, version=28619,
count=8, id=260, version=28619,
count=4, id=259, version=28619,
count=145, id=261, version=28619,
count=1, id=256, version=28619,
count=1, id=255, version=28619,
count=1, id=258, version=28619,
Quasar payload
Unsigned PE
Checks for missing Authenticode signature.