Behavioral task
behavioral1
Sample
Shut.exe
Resource
win7-20220812-en
General
-
Target
Shut.exe
-
Size
502KB
-
MD5
225bee869cfc364982f132a8b9320f1e
-
SHA1
3d13fdd4c3781a3fe0b279f5480b88150cdc1ada
-
SHA256
fc6402f6df918d0307ea6e033afebf90fde69ca6b74dc6af4d97423d00518c45
-
SHA512
e17a17f41d57dbf28fa775926e2085e19b5583c5399b2e5d36466c0d4ee70bf2eb3d3c2ae079995bcf1eee5e9c3aaa0c84fbf462dd0d8c6e5591ae2a1210a871
-
SSDEEP
6144:RTEgdc0YrXAGbgiIN2RSB3d1dcKlh/z+055QBcEivb8F9ftEnq9YcTR3L:RTEgdfYbbg7d575Qys7E1cdL
Malware Config
Extracted
quasar
1.4.0
Office04
193.149.176.156:8080
e51896b4-9928-4edd-8f19-3d5855d3388f
-
encryption_key
936C784DF6BFBCB86D89EDF1DA8425E6D70DCFBB
-
install_name
explorer.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
D3SD
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar
Files
-
Shut.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 498KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ