quasar | Client-built[.]exe | Triage

Sharing

General

Target

Client-built.exe
Size

3.2MB
MD5

76be66d7518dce8b34eb7d9b2fc39f49
SHA1

5e11492ccd1ff35570ca819a1a833b763f984f1b
SHA256

251378348a702c2e19c5d0757f921497cdfe69c1cc908e52a61e0d54c655a5be
SHA512

1a67d53663aca80b90cd19bb47559bd9bc1fd0d3fe6336006d1f3355982023467955894283ae72fe0566ee1f71fe61b3732c2897e41ed4cd64f3b23eedd388c4
SSDEEP

49152:QvRuf2NUaNmwzPWlvdaKM7ZxTwPuoLaoNdSTHHB72eh2NT:Qvsf2NUaNmwzPWlvdaB7ZxTw2o2

Score

10^/10

office04 quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

98.218.3.74:4800

2601:147:8500:53c0:959e:b4e0:7099:8e90:4800

Mutex

dd229ccb-39cd-4301-9413-ea14fa25ce22

Attributes

encryption_key
F023A1C93603AFE96871B3F0323AA7B852FA745F
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
discord
subdirectory
SubDir

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Client-built.exe

Files

Client-built.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ