Behavioral task
behavioral1
Sample
Solara-Download-main/Boostrapper.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Solara-Download-main/Boostrapper.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Solara-Download-main/Build-Client.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Solara-Download-main/Build-Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Solara-Download-main/Solara.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Solara-Download-main/Solara.exe
Resource
win10v2004-20241007-en
General
-
Target
main.zip
-
Size
1.2MB
-
MD5
34bd7cb79b747b689eb0a7c1e6429bff
-
SHA1
2ae1849a806ddb6651d36e8a9cb75911ac0c9d28
-
SHA256
370a1ac54255d09c5870186a4156f6f58894876c66f1b249a082d3cb91f482af
-
SHA512
bef00c5d12069628636fb7313c5a690d2e80c51c8ffce73fcf05beea422af8ff13e4af3ff56df99786cc32309f5435ae02074e18d447c094048eb0c9c492b025
-
SSDEEP
24576:Ht03E4sy0cXUCnlnl3zz5rNeAaEcbMMZ6VnTFepJCyCSBFt8:qlsjCnll3zMExw007B4
Malware Config
Extracted
quasar
1.4.1
Office04
192.168.0.113:4782
c82ea6b0-d255-45fb-b0eb-547ab14c0e9e
-
encryption_key
045BFCAC42C40445C0D8EBEF569DD1BF4BB62A56
-
install_name
Build-client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule static1/unpack001/Solara-Download-main/Build-Client.exe family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Solara-Download-main/Build-Client.exe
Files
-
main.zip.zip
-
Solara-Download-main/Boostrapper.exe
-
Solara-Download-main/Build-Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Solara-Download-main/README.md
-
Solara-Download-main/Solara.exe