quasar | 39234b4b1387d417161e87d99f46f5d4[.]exe

General

Target
39234b4b1387d417161e87d99f46f5d4.exe
Size 3.2MB
Sample241124-t8d6nsymft
SHA256 6c53c6883113580b6118856a433c5b2fb49a208e33d2faedb77d1e8609919af9
MD5 39234b4b1387d417161e87d99f46f5d4
SHA1 1b9239eea2e7cbf721cc4b71a7397ea49d3d0348
SHA512 0afaf23be317dafb306365e21134a00aeb650b5bb1749d8e65f9361a67200c417c042233704f01628609ca3f2c2ed9295cdcb0b945a74b99ef9e1dee541a3817
SSDEEP 49152:lnvnI22SsaNYfdPBldt698dBcjHGcHZmzO8oGdG6THHB72eh2NT:lnvI22SsaNYfdPBldt6+dBcjHGcHQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar

Malware Config

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39234b4b1387d417161e87d99f46f5d4.exe

File Explorer

39234b4b1387d417161e87d99f46f5d4.exe

.exe 3.2MB

39234b4b1387d417161e87d99f46f5d4.exe

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 6c53c6883113580b6118856a433c5b2fb49a208e33d2faedb77d1e8609919af9
MD5 39234b4b1387d417161e87d99f46f5d4
SHA1 1b9239eea2e7cbf721cc4b71a7397ea49d3d0348
SHA512 0afaf23be317dafb306365e21134a00aeb650b5bb1749d8e65f9361a67200c417c042233704f01628609ca3f2c2ed9295cdcb0b945a74b99ef9e1dee541a3817
SSDEEP 49152:lnvnI22SsaNYfdPBldt698dBcjHGcHZmzO8oGdG6THHB72eh2NT:lnvI22SsaNYfdPBldt6+dBcjHGcHQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Sharing