General

  • Target
    Full Tool Scan VPS.zip
  • Size 43.0MB
  • Sample240730-j8x9favgln
  • SHA256 95991984767349d93e902eba0487e74688ea5678a92d75a8b50a0852bd215b28
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.0

Botnet
  • Office04

C2
  • 128.199.64.220:4782

Mutex
  • a6aa1ddd-3810-492e-8728-facd9d5ede65

Attributes
  • encryption_key

    CB9F9A0F270F5BD4211B4E21054ED956F7A81814

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Detect Neshta payload 3 IoCs
  • Neshta family
  • Quasar family
  • Quasar payload 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Detects Pyinstaller 2 IoCs
  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs

File Explorer

  • Full Tool Scan VPS.zip
    .zip 43.0MB
  • Hit Sender/AxInterop.MSTSCLib.dll
    .dll 360KB
  • Hit Sender/Interop.MSTSCLib.dll
    .dll 738KB
  • Hit Sender/NLBrute Hit Sender-Checker.exe
    .exe 1.8MB
  • Hit Sender/RestSharp.dll
    .dll 186KB
  • Hit Sender/SkinSoft.VisualStyler.dll
    .dll 1.0MB
  • IP Scanner (Thay thế cho MassScan chạy trên Guest hoặc không có quyền Administrator)/IP Scanner.exe
    .exe 12.3MB
  • ScanIP.pyc
    18KB
  • KPort Scaner/KPortScan V3.exe
    .exe 232KB
  • KPort Scaner/QtCore4.dll
    .dll 2.4MB
  • KPort Scaner/QtGui4.dll
    .dll 8.0MB
  • KPort Scaner/QtNetwork4.dll
    .dll 982KB
  • MassScan/Input.txt
    489KB
  • MassScan/Massscan_GUI.exe
    .exe 334KB
  • MassScan/Packet.dll
    .dll 94KB
  • MassScan/_config.ini
    40B
  • MassScan/masscan.exe
    .exe 232KB
  • MassScan/msvcr100.dll
    .dll 755KB
  • MassScan/winpcap-4.3.exe
    .exe 423KB
  • $PLUGINSDIR/InstallOptions.dll
    .dll 14KB
  • $PLUGINSDIR/System.dll
    .dll 10KB
  • $PLUGINSDIR/final.ini
    278B
  • $PLUGINSDIR/nsExec.dll
    .dll 6KB
  • $PLUGINSDIR/options.ini
    286B
  • $SYSDIR/Packet.dll
    .dll 99KB
  • $SYSDIR/pthreadVC.dll
    .dll 52KB
  • $SYSDIR/wpcap.dll
    .dll 275KB
  • MassScan/wpcap.dll
    .dll 220KB
  • NL Brute 2/NLBrute.exe
    .exe 7.8MB
  • NL Brute 2/settings.ini
    137B
  • NL Brute 2/tối uu VPS ram cpu.exe
    .exe 502KB
  • ScanIP.exe
    .exe 12.3MB
  • ScanIP.pyc
    18KB
  • UsefulRDPScript.exe
    .exe 54KB
  • nVNC/bin/config.conf
    267B
  • nVNC/input/passwords.txt
    21KB
  • nVNC/nvnc.exe
    .exe 3.5MB
  • password.txt
    5B

Full Tool Scan VPS.zip

  • SHA256 95991984767349d93e902eba0487e74688ea5678a92d75a8b50a0852bd215b28
  • MD5 SHA1 SHA512 SSDEEP