quasar | ninjacs-cheats[.]1[.]24[.]zip

General

Target
ninjacs-cheats.1.24.zip
Size 1.3MB
Sample240910-xf68jaygpr
SHA256 554e7e2e25ae024c8b26330f0784c97662e5149856409dea58a31572828ee6f4
MD5 bc2184731d04864e445608edd3778ab7
SHA1 bc9185ffa29c24f6d6097315f6aa7a5b39696714
SHA512 c931dceca92f0882abc3b9f9f04b9e46f2c48188ca5ffc07975b1d8b52165dbbbe8f78cf38c87dc9afa6025cad6ec1bb1815d250d6acc6bf251e4431ba51b712
SSDEEP 24576:iCEazZfWZeSVYlKA554nLKvU9xhs9H3xEY3H6hssw74IHHwVqcd0:FEsWZeHljmnmvU9xhsV3iY3UkvHHYrd0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.172:4782

Mutex

382b9dc0-4bf3-4997-93ae-50baf6d6b555

Attributes

encryption_key
1B7B40665D2A7961DF6AE36039C18AEC4E143760
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Security Health Service
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe

File Explorer

ninjacs-cheats.1.24.zip

.zip 1.3MB
ninjacs-cheats.1.24/ninjacs-cheats/Readme.txt

111B
ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe

.exe 3.3MB

ninjacs-cheats.1.24.zip

SHA256 554e7e2e25ae024c8b26330f0784c97662e5149856409dea58a31572828ee6f4
MD5 bc2184731d04864e445608edd3778ab7
SHA1 bc9185ffa29c24f6d6097315f6aa7a5b39696714
SHA512 c931dceca92f0882abc3b9f9f04b9e46f2c48188ca5ffc07975b1d8b52165dbbbe8f78cf38c87dc9afa6025cad6ec1bb1815d250d6acc6bf251e4431ba51b712
SSDEEP 24576:iCEazZfWZeSVYlKA554nLKvU9xhs9H3xEY3H6hssw74IHHwVqcd0:FEsWZeHljmnmvU9xhsV3iY3UkvHHYrd0
MD5 SHA1 SHA512 SSDEEP

ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fc8bae38abe7f009997cc8b904da76ef27864e7dcaa4878b98315251ba802328
MD5 a9ea6013b5394f208d42380bd9b1c0ad
SHA1 b2f56ec971eb7525ce506ff4f5e3d840d19bf308
SHA512 82338288341c907cc9fa6caa07a66f2302ac44463589994bf6131401c5c452b72ec1ed604d37980321769b463ba3bd8b40ee894b531ff48b32ba31531799f6af
SSDEEP 98304:RvT22SsaNYfdPBldt6+dBcjHL+RJ69BWqh3m:V07jYcHhW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3269662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ninjacs-cheats.1.24.zip

ninjacs-cheats.1.24/ninjacs-cheats/Readme.txt

ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

ninjacs-cheats.1.24.zip

ninjacs-cheats.1.24/ninjacs-cheats/Readme.txt

ninjacs-cheats.1.24/ninjacs-cheats/ninjacs-cheat-program/ninjacs-cheats.exe

mscoree

dotnet