quasar | Client-built[.]exe

resource	yara_rule
sample	family_quasar

resource
Client-built.exe
unpack001/aforge.dll
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/gma.system.mousekeyhook.dll
unpack001/protobuf-net.dll
unpack001/pulsar.common.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll

Client-built.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6736277b01741744fed0b7040ffda822a7810a6b7ef0faa6c79c2a7fc33da541
MD5 7bdb7261cfb59ab4b8bd4a3ad2747d14
SHA1 9fff5d0d663b65c7d4c39080a9137212765914e9
SHA512 ca8303c91b9b0b2eff29e407caf75824c118f308a8c6aa5667f0398725a2ea6b0beead35848c5cd7243da400f5a1835bb88f89cfce62f63125a0cd4161d5afa7
SSDEEP 24576:UdDl5UMSWHIPbcNK0KKfaOwI55l2SR8EEJrUOz:iDlKGEgKKHwCBmX
TLSH
T10B15E110BBF8C217F1BE9BB9E4B252450B71F8039966E74F1DC8A0A81DA6355CE91373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

924110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
MD5 02c63f568e598aad85dd401d7b26e82a
SHA1 2da9ec7612835e1f69d4a93aa2d49ec9bdff7f7c
SHA512 da9bff86be8fa890dda80a35ee6c851aa655f087f81804a23c73f8c586b7e13ac5a643e0a516a35787cd97b392aec16bfb95210080e4e53e6144fec9316acdb1
SSDEEP 384:aJtTjIFgPn1Q11umcaOxIapDtoTFC6dmoU:KRcFKoumc9ICDyxmoU
TLSH
T18582B50DEF9CC267CE6F5A7460DB13598335C70AA653DB6784EC04A4AC47389ADA3293
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Core\obj\Release\AForge.pdb

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

gma.system.mousekeyhook.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
MD5 41b34eab1585d5381c56730b93dd1310
SHA1 510b640517342dbcc40c81b63db23fa1444a71ed
SHA512 14abe45c04c9620a0f1c4a5ea3882f8388d0d73f497b84020033ce9d3f8d49922694580aedea5e75652101df3c98818f3ebc4ce2865d75e77fdaf3b18b3c354a
SSDEEP 768:I/t9KqM6Un424sqnGxnRLTxT2Wjq7oEs+DfQ9n5xXK:Ilgl6a424sHXv93ji/siY9ni
TLSH
T169436B24835C0337CBDD8B3FA476412A87B1D7863953EBB7AB9881F02867B541929377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9429f05aa4ab1ef92a0237410ea103cffa406b071953d50f5e7a55496d517c02
MD5 1c2c6b341535661b7501f5c4a434a78e
SHA1 f45aefa816f86830bee41c0e5426e641d5af3c06
SHA512 14b8653b04865a8efeda23149cd624cbe0ebd6e676a7f9cb4ba994a129cba975b9eb928de0f396eb3a37449469549ede36ec2ceec7e61d68773fd72c422fef8e
SSDEEP 6144:oRxmgHi29FKwOOZmI3jnX2/aNVm12bEm:8BC29HOgmwL2/ao2bE
TLSH
T1CF546B1467ED4A1AE2FFA3B4E838181C47F6F506622EFB8D14A091FD5953BD086007BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

296722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

protobuf-net.pdb

pulsar.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e891c3702edeae8e9eb3950c6bf7779b27b0be239cc769f64404c782ec45f054
MD5 363d4adc1f141288a796e38843ee1cba
SHA1 eba242776305aeb448bf1cc02c1ec7eca24ad0d1
SHA512 de4aac6b183efdb97ae2f899a44a81722149ad3c6f5b314f8727813ebf8850b72f951a9dc87dc643ce9734b92f8367697ca4003ea9f552c151572856ff0a00b7
SSDEEP 1536:sxVxVS8SqEenXZr7dsOPr/BxZ+PFyolZw:QQ8SoJtr/BxsPFpZw
TLSH
T1AA83C6119B68C36EC39D47FAF865053E8375918A3010EEFF9B49F48A7D62783600A5B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

87862

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f525e33494f4cd2a560a71cdf237303a3fb54a8fa44e1693eba35c9245c60a
MD5 07137e5cc4d5ecc95ca267c9dce042d4
SHA1 d82f5e3d718bc9172fcfe0e8c50cb20251762058
SHA512 9d1d6eb2887653260b62a24d3ab2c358bf15b89f68a1a3a1104f1eb5362725eb535218b9a53211f9cdb67d7793ce346c520a289d66c3edf786b0da5db7c39f0c
SSDEEP 3072:zTlyoOCGOd8DxSEjnhkHTI4A2j4xBJz+gM5w9HDAVvbLvm5KhgeeCjDrgvmjG0Wz:N3n2lB+xQyUeklXAknj1ur
TLSH
T16254F911EA084E8BC98E55FEBC12F90782F98C15004AF7A7E84DC59B1ED23D9D91E7C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

288270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.Direct3D11.pdb

sharpdx.direct3d11.pdb

SHA256 bba95514fb062788c9aec9cd7bc553cf47843c42ca5eb572814ff4b7c82ce7fd
MD5 1600d8adb3e99f85c1e9719e59828559
SHA1 a2259a45ea284247b3aa65ec9c1dbebd47fe208f
SHA512 dd967ab0f86d77fef2e09830c00f318020b519205dd6f8be70fb5d07fd5f6b988ace83487b56ee49973216b385dcaf802408223aa0fd6d9f6203dac6066bcc00
SSDEEP 1536:CpHzmX5+N9aIcSyP6JFzIocUNX290MKc7P9tOaZQTZH:CpyTmyiJFzvNX29frPaTZH
TLSH
T16173E90BEA84AF2ADF574D30586391067374A148DB8FDF47A6DCA33B9C9B794486390C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0af255ea4b09a8cdb995b8c6fd1075e46f098e23c2351c974e6ded9b8b620cf
MD5 c52a44933d17d576d4c97b4cb0545841
SHA1 092696fdcc034910aa02c94a5c93f4e1e86e0c50
SHA512 8273ddb86a54c4834d469bbc856d1793c86f2577e21411f30083d4e597427170fd9ca38da2e86f081d284043d5ea4a6d3330037eededd17e37aa885927d0a76d
SSDEEP 6144:IyfsmUCs3Zchh2UBSFKu033XbEUsHBEAT0C:Iy7UCs3Z22UXuwbkHBX
TLSH
T118446D36FF0C1A93CD8E46BAAD63951303B098102552D64FB944A6AD2DCF7847F267E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

280462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc0243134c93c55ea105d0e9c2a43b6030e973290d0a061cf3a61986a2268a88
MD5 d2edde626c241549eab636aa87fb5d38
SHA1 8d836febd477b3ec44cc37f4f0aecdaa1d7db788
SHA512 490878e20ed764e81e42b8f43faf2adc0810dcd2f65d36f6d6980411617fae9543f0d7b6f110e5363be494097ba3b30dcf3695aea41314fbe19c6a59a55538d1
SSDEEP 1536:x/xP0dmNHRIfvXyTjUxk0+8shTbRqpzMA1JhkrIAcFpZMD9hVRg5bT+02nBJdbea:x/OSSfP60kpVxbUuZKq/4qaTXc
TLSH
T1CDE321826D7483B4E9CF7FBEE695B92A5523F1110481B64612E27A004BC52438F9FFDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Quasar payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SharpDX.DXGI.pdb

sharpdx.dxgi.pdb

SHA256 adc6991011da455e001f537db1970b2208d960ba7e66d4d4a534d293235b4463
MD5 44e3cf00d4eda7f4aa38044d578aa537
SHA1 d73e59804e3ee494a4612185771f7f67b2fd64ae
SHA512 b83080b7968e5b32dd7b1be70eb7f9bde797de248a5b4c5c94eea6ec0342ad8fa78b4ff46e63835edca340c3f3b254044f0348bc84f728edd37db1ec223030dd
SSDEEP 384:JNne+E628lTYV+5Puni3MKW6kqQ9aRrwytEc8nl0FXGwxXl3kKjF2kCkB72KRleh:je+E628lv5Gi3MKWNqR928ksF2t4lg
TLSH
T151F2604AEFA4931EC3239B7594A3A32303749149CFDB471B13DDB7296C4A3E84DA295C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

sharpdx.pdb

SHA256 4109cfff6e17d9bd2efdc7fd52a4f544b5c66c9743c9e8ccf7d8a2f6cfc23eb7
MD5 2883c3a35927e62ebe1871c130e93f31
SHA1 1a7c10aa582cceebffd9bc77a11353aaae6417e9
SHA512 9bc6cdae59163756f9110867353e513cf53003a2c171e9458d920d83a8d025ab9dcffc3278309223e9ba257b88cdb3f7f5c23ba78bb8ca4168b74f91dace8658
SSDEEP 768:wIla9Y6ZBiygU1v+cALYbshPln6wWxwAU/fHKcnLQ8:CO0zWcQEIlnxF66
TLSH
T10213C506D9A68B2BCA56163E4F3347155B30E28CEA06CB0713EDF7B5AC5BB040DA356C
MD5 SHA1 SHA512 SSDEEP TLSH

Quasar payload

Client-built.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

gma.system.mousekeyhook.dll

mscoree

dotnet

protobuf-net.dll

mscoree

dotnet

pulsar.common.dll

mscoree

dotnet

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet

sharpdx.dxgi.pdb

sharpdx.pdb

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Client-built.exe

mscoree

dotnet

aforge.dll

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

gma.system.mousekeyhook.dll

mscoree

dotnet

protobuf-net.dll

mscoree

dotnet

pulsar.common.dll

mscoree

dotnet

sharpdx.direct3d11.dll

mscoree

dotnet

sharpdx.direct3d11.pdb

sharpdx.dll

mscoree

dotnet

sharpdx.dxgi.dll

mscoree

dotnet

sharpdx.dxgi.pdb

sharpdx.pdb