Resubmissions

13-01-2025 00:18

250113-alx6gsypem 10

05-01-2025 12:00

250105-n6nz7swjek 10

General

  • Target

    1riage Fiddler shit.zip

  • Size

    28.9MB

  • MD5

    7dec47dd246b6a81c9f0992091ef2d03

  • SHA1

    c46e9addf83d24adeb036b8ed33a6dd13c024ede

  • SHA256

    28327d9e90781c714d6951c767b3fa88396048b81178e9b691ab8edef0e59cf7

  • SHA512

    2b2469a6535a311d8e3cc4fb4b0aac852b3e5a15306d3f53c83255867e61314ba1adb0a1ae2089160b61a48634d388efafda6813c8020b94e2046a57e68a2de6

  • SSDEEP

    786432:CBzytd5XjMdi0R6fu29sdi0R6fu2z+2UqeESHo4t/Isp:YzyRQRd2mRd2fMf

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

robot

C2

tcp://quasarrat12345-50279.portmap.host:50279

Mutex

5b3b6ef6-1f5c-4cf2-a902-f38fc18c6f74

Attributes
  • encryption_key

    044C06AD5B6394C7D3CCD0919FA2C67D30EA87D4

  • install_name

    SolaraV3.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • 1riage Fiddler shit.zip
    .zip
  • 53minsagobyforthisisaryoku1992-codexroblox.zip
    .zip
  • Qt5Concurrent.dll
    .dll windows:6 windows x64 arch:x64

    a6d359db9d425cd97b997335b16fabe8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x64 arch:x64

    e8a373955db6ba04b088bbc9903bb82f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Script.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • bin/d3dcompiler_43.dll
    .dll windows:6 windows x86 arch:x86

    6ba7b0e4e74a8eea96dca4fffc88b859


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    cbe70f7d9d10cd8df377e2bdaae30384


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-1_1-x64.dll
    .dll windows:6 windows x64 arch:x64

    9e838455ae7ea799f93ad26b13f1cafa


    Headers

    Imports

    Exports

    Sections

  • bin/settings.dat
  • bin/tbb12.dll
    .dll windows:6 windows x64 arch:x64

    352dee577dba5dbc88c1bf063a46f2d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FiddlerSetup.5.0.20245.10105-latest.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/FiddlerSetup.exe
    .exe windows:4 windows x86 arch:x86

    9dda1a1d1f8a1d13ae0297b47046b26e


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • Analytics.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Analytics.pdb
  • App.ico
  • Be.Windows.Forms.HexBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Countdown.wav
  • DotNetZip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EnableLoopback.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • EnableLoopback.pdb
  • ExecAction.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • FSE2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Fiddler.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Fiddler.exe.config
  • Fiddler.pdb
  • ForceCPU.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • GA.Analytics.Monitor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • GA.Analytics.Monitor.pdb
  • ImportExport/BasicFormats.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ImportExport/BasicFormats.pdb
  • ImportExport/VSWebTestExport.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ImportExport/VSWebTestExport.pdb
  • Inspectors/QWhale.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Inspectors/QWhale.Editor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Inspectors/QWhale.Syntax.Schemes.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Inspectors/QWhale.Syntax.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Inspectors/Standard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Inspectors/SyntaxView.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • LoadScript.wav
  • LoadScriptError.wav
  • NOTICES.txt
  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Plugins/NetworkConnections/Telerik.NetworkConnections.Windows.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ResponseTemplates/200_FiddlerGif.dat
  • ResponseTemplates/200_SimpleHTML.dat
  • ResponseTemplates/200_TransPixel.dat
  • ResponseTemplates/204_NoContent.dat
  • ResponseTemplates/302_Redirect.dat
  • ResponseTemplates/303_RedirectWithGet.dat
  • ResponseTemplates/304_NotModified.dat
  • ResponseTemplates/307_RedirectWithMethod.dat
  • ResponseTemplates/401_AuthBasic.dat
  • ResponseTemplates/401_AuthDigest.dat
  • ResponseTemplates/403_AuthDeny.dat
  • ResponseTemplates/404_Plain.dat
  • ResponseTemplates/407_ProxyAuthBasic.dat
  • ResponseTemplates/502_Unreachable.dat
  • RunNsisUninstallers.bat
  • Screenshot.wav
  • ScriptEditor/Analytics.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ScriptEditor/Analytics.pdb
  • ScriptEditor/FSE2.exe.config
  • ScriptEditor/GA.Analytics.Monitor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • ScriptEditor/GA.Analytics.Monitor.pdb
  • ScriptEditor/QWhale.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ScriptEditor/QWhale.Editor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ScriptEditor/QWhale.Syntax.Parsers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ScriptEditor/QWhale.Syntax.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Scripts/FiddlerOrchestra.Addon.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/FiddlerOrchestra.Addon.pdb
  • Scripts/FiddlerOrchestra.Connection.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/FiddlerOrchestra.Protocol.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/FiddlerOrchestra.Utilities.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/QWhale.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Scripts/QWhale.Editor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Scripts/QWhale.Syntax.Parsers.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Scripts/QWhale.Syntax.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Scripts/RulesTab2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/SampleRules.cs
  • Scripts/SampleRules.js
    .js
  • Scripts/SimpleFilter.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/SimpleFilter.pdb
  • Scripts/Timeline.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Scripts/Timeline.pdb
  • Scripts/netstandard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • SetupHelper
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Telerik.NetworkConnections.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Tools/Brotli.exe
    .exe windows:4 windows x86 arch:x86

    abde5b16095d3ba52da82b2720c99f51


    Headers

    Imports

    Sections

  • Tools/JXR2PNG.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Tools/JXR2PNG.exe.config
    .xml
  • Tools/PngDistill.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • Tools/PngDistill.pdb
  • Tools/Zopfli.exe
    .exe windows:5 windows x86 arch:x86

    0ee9b066fb0acca861b061bc6205cb49


    Code Sign

    Headers

    Imports

    Sections

  • Tools/dwebp.exe
    .exe windows:5 windows x86 arch:x86

    2d085d0bc738a6c295d68bd5aed725a8


    Headers

    Imports

    Sections

  • TrustCert.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • TrustCert.pdb
  • credits.txt
  • license.txt
  • makecert.exe
    .exe windows:6 windows x86 arch:x86

    8edc201d42ea718d1e65bb5d3125c066


    Code Sign

    Headers

    Imports

    Sections

  • saz.ico
  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    f4639a0b3116c2cfc71144b88a929cfd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    509a34b3a68a773e0afb4259e68f9f82


    Headers

    Imports

    Exports

    Sections

  • Script.zip
    .zip
  • Qt5Concurrent.dll
    .dll windows:6 windows x64 arch:x64

    a6d359db9d425cd97b997335b16fabe8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Qt5Core.dll
    .dll windows:6 windows x64 arch:x64

    e8a373955db6ba04b088bbc9903bb82f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Script.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • bin/d3dcompiler_43.dll
    .dll windows:6 windows x86 arch:x86

    6ba7b0e4e74a8eea96dca4fffc88b859


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • bin/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    cbe70f7d9d10cd8df377e2bdaae30384


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-1_1-x64.dll
    .dll windows:6 windows x64 arch:x64

    9e838455ae7ea799f93ad26b13f1cafa


    Headers

    Imports

    Exports

    Sections

  • bin/settings.dat
  • bin/tbb12.dll
    .dll windows:6 windows x64 arch:x64

    352dee577dba5dbc88c1bf063a46f2d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Solara V3/Read Me.txt
  • Solara V3/SolaraV3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Solara V3/wiarpc.dll
    .dll windows:10 windows x64 arch:x64

    efbaf14e4250b5c7da58fe8172f49d90


    Headers

    Imports

    Exports

    Sections

  • Solara V3/wiaservc.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    886dde22a75f2bd5d6a984f4b6cd9636


    Headers

    Imports

    Exports

    Sections

  • Solara V3/wiashext.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    ec21291681095a701f38c649eb1e9940


    Headers

    Imports

    Exports

    Sections

  • scriptzip/Qt5Concurrent.dll
    .dll windows:6 windows x64 arch:x64

    a6d359db9d425cd97b997335b16fabe8


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scriptzip/Qt5Core.dll
    .dll windows:6 windows x64 arch:x64

    e8a373955db6ba04b088bbc9903bb82f


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scriptzip/Script.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • scriptzip/bin/d3dcompiler_43.dll
    .dll windows:6 windows x86 arch:x86

    6ba7b0e4e74a8eea96dca4fffc88b859


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scriptzip/bin/libEGL.dll
    .dll windows:5 windows x64 arch:x64

    cbe70f7d9d10cd8df377e2bdaae30384


    Headers

    Imports

    Exports

    Sections

  • scriptzip/bin/libcrypto-1_1-x64.dll
    .dll windows:6 windows x64 arch:x64

    9e838455ae7ea799f93ad26b13f1cafa


    Headers

    Imports

    Exports

    Sections

  • scriptzip/bin/settings.dat
  • scriptzip/bin/tbb12.dll
    .dll windows:6 windows x64 arch:x64

    352dee577dba5dbc88c1bf063a46f2d6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • solare.zip
    .zip
  • solare.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • update.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections