General

  • Target
    Client-built.exe
  • Size 3.1MB
  • Sample261109-reqw9scv5w
  • SHA256 07d456b5888d4676842f1a365c92c3a256a626437a435cf36121aaad927ae6e6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.1

Botnet
  • au88

C2
  • mm99.qpon:4782

  • mu88.uk.com:4782

  • koinslot168-f.cc:4782

  • pabwa.africa:4782

  • mu-88.sa.com:4782

  • awedi.africa:4782

  • slotslotbentley.cc:4782

  • mm88speed.com:4782

  • shio4d.com.co:4782

  • xgirls.in.net:4782

  • www.lifeatsea.in.net:4782

  • patur.in:4782

  • moviesda3.co:4782

  • restorepi.co:4782

  • alquimi.co:4782

  • boatique.co:4782

  • awakespace.co:4782

  • gambey.in:4782

  • thecoffeenomad.co:4782

  • koshikien.co:4782

Mutex
  • 273696bc-a6b2-4c7a-9e8a-e8ad984ce338

Attributes
  • encryption_key

    61D61573755A2E8791F777F44FE72A8C404B3F90

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    500

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Client-built.exe
    .exe 3.1MB

Client-built.exe

  • IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
  • SHA256 07d456b5888d4676842f1a365c92c3a256a626437a435cf36121aaad927ae6e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Quasar payload

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
4
Entry point
3280110
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths