quasar | VIRUS[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

VIRUS.exe
Size

267KB
MD5

9b0cc9edfda0b6aa61cf42ee2edcda2c
SHA1

5b54c993d2e89deb1e11c6d04256e6f18514919c
SHA256

159ae873db96ed848b88d5ff0288832ecaee3e33b29029cf02f38b2804727952
SHA512

d1a0bce4606acc109c17c7c39eeda5733e19d5b5c490b0d6d0c46031d29646519c9d97805837a7a664ad54754b8ffae4b8e88252657d1e4502d81c43bdee8afa
SSDEEP

3072:MaaXQh1zKfB0OZpbsxFqc9faDz5o5rx5L+yoXG9xXb46Ly+QE9K0tjbXsXMErp5:MaaXMzUmOZoqPo5H6lW9BbYpE9/O3

Score

10^/10

quasar

Malware Config

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
sample	family_quasar

Files

VIRUS.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ