quasar | FortniteID[.]exe

resource	yara_rule
sample	family_quasar

resource
FortniteID.exe
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/naudio.core.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll
unpack001/protobuf-net.dll
unpack001/pulsar.common.dll
unpack001/sharpdx.d3dcompiler.dll
unpack001/sharpdx.direct2d1.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll
unpack001/sharpdx.mathematics.dll

FortniteID.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 38224d8dc975a31ba3db87a7d247b8a9b8082753b7c3ccf3539219ce1c4b56e6
MD5 123c55330edb1f57bfa4573cf468cf77
SHA1 8cf23862d5d2c8e4a2f9fdde5fb7ffd4c6ba67d1
SHA512 ab9848aeeddf65bb2c98c1e9cf568bb910bd874ebf36feff7469fa4c87d498cbf7c3c95e2198eb6b2493425a1617ecb8c54330a83061df3905c13b6384c7a1c4
SSDEEP 24576:ipL3MUn5qwS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9lszBKy+:ipXn5v7wR2EgKKm77LrwCB6A8
TLSH
T17875F002B7F9810AE5BF5BB9A87356540737F9039E3AC74E498C906D1EE33409E527A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1628142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
MD5 41b34eab1585d5381c56730b93dd1310
SHA1 510b640517342dbcc40c81b63db23fa1444a71ed
SHA512 14abe45c04c9620a0f1c4a5ea3882f8388d0d73f497b84020033ce9d3f8d49922694580aedea5e75652101df3c98818f3ebc4ce2865d75e77fdaf3b18b3c354a
SSDEEP 768:I/t9KqM6Un424sqnGxnRLTxT2Wjq7oEs+DfQ9n5xXK:Ilgl6a424sHXv93ji/siY9ni
TLSH
T169436B24835C0337CBDD8B3FA476412A87B1D7863953EBB7AB9881F02867B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
MD5 48867f392b8e77dc06c062638c6fbd36
SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
TLSH
T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
MD5 278ebb79da14ecf8e0559530c2fda076
SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
TLSH
T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

185178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
MD5 be8205f435b2afbfd178960c46310c17
SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
TLSH
T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
MD5 faf1ba532964984a34d60674fbc7a5a7
SHA1 0999178949de510a47d87de3b8a117a003c572ee
SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
TLSH
T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

63254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9429f05aa4ab1ef92a0237410ea103cffa406b071953d50f5e7a55496d517c02
MD5 1c2c6b341535661b7501f5c4a434a78e
SHA1 f45aefa816f86830bee41c0e5426e641d5af3c06
SHA512 14b8653b04865a8efeda23149cd624cbe0ebd6e676a7f9cb4ba994a129cba975b9eb928de0f396eb3a37449469549ede36ec2ceec7e61d68773fd72c422fef8e
SSDEEP 6144:oRxmgHi29FKwOOZmI3jnX2/aNVm12bEm:8BC29HOgmwL2/ao2bE
TLSH
T1CF546B1467ED4A1AE2FFA3B4E838181C47F6F506622EFB8D14A091FD5953BD086007BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

296722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.pdb

pulsar.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 25654bb37f1247374916b140301f61d665238bb723d0c072560635b1f329b7e9
MD5 2358adfd8c5f1ef45b1cb094d9ddbf50
SHA1 786fadb531ee90fcfa63ded6f7dd0837b0ed5a3f
SHA512 86351515bf2f1477490ca8d13bead51c8e9604e9e19fa2d2c07692eaf5bc1c0f9815ab921acce6dcb88fa530414b8cb8ac49b23152c59aa2fd4951d427165bd4
SSDEEP 1536:vYJDNZUfllTNH+qsd/sJd2ouVn8//sacH0mv2:uNZUf/Af/syZVn8//Dcnv2
TLSH
T18583E71257A8836EC36E093EF5B24A7A072593897111DBBE8B44FCCA7E237C150359F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

91438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sharpdx.d3dcompiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 268b44a78354f7a225e5b1567223179c7b73453c0a27eb4bf18bb57d7a8e08d9
MD5 66aeaaba0629daf8544afc8008079386
SHA1 1e09e5d24e1aa3d1700b265c6ff94b7524813f4d
SHA512 dd2cd1df484600e6cc3e686e64559c3447f255f723b5f57cd51f76a838a79416bf68b7a7b380467bce172fc3ec868eb54a0d754108926782d31bb0cbd66f5a54
SSDEEP 768:VbFZAPoGIjmU9ZMPVNOhTJCj+775suxTvJREFhtK4shNeYJub4h8ZGdwv1PmQYEQ:Vm9SXGunREFhtKhNeA+4h8Md81VYExO
TLSH
T1E4434D21E7486256F68E0BFDB0264F064331F2467417E78BB9CC98E52D97354EB1A3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.D3DCompiler.pdb

sharpdx.d3dcompiler.pdb

SHA256 226f82b448c2f8700ca5c9f3658a0808a251f98d8543753e6231bc41b2a2053c
MD5 3c7ce2802daee6dba9e39970995c4069
SHA1 4fb7a312cc269cb44487b0fee6b94695024a6b0b
SHA512 203b5f374ae63ad4f9a3f926d8d0afd351f2886d6b3a1ff6d0356c080980e850b9934b875b34accab8eb0382a69b168c3497484bd2ce9f2f4b23b5230d751ac6
SSDEEP 384:OXwP73y8HB6AreJkS9RBbwX/QreSLG1UI43I6Y3Ix:OXmyiB6hkSVsoFI60Ix
TLSH
T1ABA29415E3E0AD3DDB833A3760636327837DD04886CB8F0712ECD7BABD997044666A59
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct2d1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f4b5e240cb42ce903082f81633bba0c781c1e684fd5903bc3915e3805b5e83e
MD5 b992dfabf27b4c32c57d5cc2960cd8e3
SHA1 b012190d4cefbca3c63218f8fcd6e7211de40913
SHA512 f6d86cb73cb44c2d0ced4585f628f953ff604adde07da724f64122c6d07536985c4052a4aadfabee69f16a47797ef87f48e46eb5ff9601d0d3564aa4979f9467
SSDEEP 6144:90MJT4AfGTJX022MfHZJo/AuiEqQvWW9mArUXCxfBRh2O4OFr77:l4BJECZSxBW6mvS7RhQ8r
TLSH
T1B8B44B1127D84B2BD98D5EF7D171861892F8D10BB227EB4B398691794DC33214E0EBEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

500894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct2D1.pdb

sharpdx.direct2d1.pdb

SHA256 c85d2fd579c5ddc47d6c7f9a399558931447c66cc878218fdf78708103a4c5ab
MD5 b7e9ec399d002f3c92a80d73296b8fee
SHA1 44e30b6f808b43a07716f804cf694f95ebeeaac5
SHA512 68222884e0dd0b4d9552717efa64ddbcaad8f12c83f8bf6e32f6b2d2699021ec73f005c21a981857a723f862aac58e09ba819958a3736a45c75930011158af30
SSDEEP 3072:DSaGja/imizEYq7wlvNqrrFdnW7SXuIC8MsjjHtZRRftTFZ2aOO:x6ev4EYq7SvNqVdncIC8Ms7RjTFZrL
TLSH
T1E824D70AEA58831DCB368A3515A7D2162370D288DC4FDB4FB6ECA7391C5B78A04B357D
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 07137e5cc4d5ecc95ca267c9dce042d4
SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
TLSH
T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

288270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct3D11.pdb

sharpdx.direct3d11.pdb

SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
MD5 1600d8adb3e99f85c1e9719e59828559
SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
TLSH
T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 c52a44933d17d576d4c97b4cb0545841
SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
TLSH
T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 d2edde626c241549eab636aa87fb5d38
SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
TLSH
T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.DXGI.pdb

sharpdx.dxgi.pdb

SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
MD5 44e3cf00d4eda7f4aa38044d578aa537
SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
TLSH
T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.mathematics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c9615496970ea84320e2a6e99f8fb828e3c7790384df5585d93fc368885d94e
MD5 50e6524b7ee9c2c93f5210b63cb1ca54
SHA1 3e296ec3bb24750833ea80515e6fb4c73874c91a
SHA512 f9d3b296e14d72f4bff727acfdcfb520ae1436ba5ded03be04a559f493d4a8f9f915c0a2f498214309d0b84d6b3ae29750186615ae3250ad218aeb09dd7175ab
SSDEEP 3072:BW+i1u3AZ2YRCPJ4e3qHKSOZ53ZSOUE5Cgil7MEcR5hpGO5wZ+iEZUn1Bt+ZknSB:BdAZDCziyEs5Pib+ZknSTpc
TLSH
T14324E75CCFEB4576CBAACAF9F01D0EDB67295158122FEF1AB19894FA0803369D1012D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

221054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Mathematics.pdb

sharpdx.mathematics.pdb

SHA256 ca3492f46e271c70182d04783b4731c6a6ead3659ffa22ec02a758b3905e8508
MD5 2056464074215066d3d06abbba1a0519
SHA1 c2d459a790cb21aa1c8fa92f55b96804aefb78aa
SHA512 eedef1f1dcead2f15928d24028c62b518f7f6b89a4e739b64c3c1fae0b1123dc9c1a6ce024187cf2656cf5620ca670858435ab6d9c34ef9a99e283b1c14bcdf9
SSDEEP 1536:1ernxRpKZkJklUHHIWNVXVxYGGGGGGGjQYXHEmM7F7MlXZE747fBL/zdx:cbKK1NVXJTXkt7F78e747fBLJx
TLSH
T179938327CA888606CD06A9778972072533B9D0A8974D9F4663DDF379FCA3B50A9D334C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.pdb

SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
MD5 2883c3a35927e62ebe1871c130e93f31
SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
TLSH
T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

FortniteID.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

gma.system.mousekeyhook.dll

mscoree

dotnet

naudio.core.dll

mscoree

dotnet

naudio.wasapi.dll

mscoree

dotnet

naudio.winforms.dll

mscoree

dotnet

naudio.winmm.dll

mscoree

dotnet

protobuf-net.dll

mscoree

dotnet

pulsar.common.dll

mscoree

dotnet

sharpdx.d3dcompiler.dll

mscoree

dotnet

sharpdx.d3dcompiler.pdb

sharpdx.direct2d1.dll

mscoree

dotnet

sharpdx.direct2d1.pdb

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet

sharpdx.dxgi.pdb

sharpdx.mathematics.dll

mscoree

dotnet

sharpdx.mathematics.pdb

sharpdx.pdb