Behavioral task
behavioral1
Sample
76257feb8d753a419e11bd0672eac3d236ac990d8ba8baf7ec44c5f1f3eac591.exe
Resource
win7-20220812-en
General
-
Target
1f8f68e7623630103601f6235e9c94a6.bin
-
Size
229KB
-
MD5
1d47eed56c4d28b3d42c1c0b835bbd2d
-
SHA1
e999ea108fd6b36ffa384a65f55e9567906e93e7
-
SHA256
e51a6cc27a8e9f21f56404bcf479978db71825bd61ed6eaf4570b5d64edbe2a2
-
SHA512
a7b339f6cafb5d959cef245e4ea938ae319c7ce05a4f862a463ecd2d9a7b7d9a7c86c74068b8a984d2880de8d03b95a07511ad4ff7ef36c2004a28d0dc1d0ac6
-
SSDEEP
6144:w6jdLkH/t+Lq0A0N+ue+3Y5soGZHOg7DIUnNjBT/fEV4K6XkK:w6hLksq+Xo5GZHOgHJTnEVrEr
Malware Config
Extracted
quasar
1.4.0
Office04
192.168.1.237:1290
0cdb9102-24f8-4ed6-ba0c-d7625d69d684
-
encryption_key
63E6BFBD5330A53154091A63A8847C4FAA484D23
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
2899
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule static1/unpack001/76257feb8d753a419e11bd0672eac3d236ac990d8ba8baf7ec44c5f1f3eac591.exe family_quasar
Files
-
1f8f68e7623630103601f6235e9c94a6.bin.zip
Password: infected
-
76257feb8d753a419e11bd0672eac3d236ac990d8ba8baf7ec44c5f1f3eac591.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 498KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ