Behavioral task
behavioral1
Sample
BF45D2F0B91865FC40060820980C9CF3A02C0CD42788B.exe
Resource
win7-20221111-en
General
-
Target
BF45D2F0B91865FC40060820980C9CF3A02C0CD42788B.exe
-
Size
502KB
-
MD5
25143aaeca811f4e42df904f96d6fc03
-
SHA1
2970f0d3a80dfcb65e39f6e015034e83e6476bd4
-
SHA256
bf45d2f0b91865fc40060820980c9cf3a02c0cd42788bc954c8a84a81111d42c
-
SHA512
06526d154a406700b4e57142bb4d51db33e7600e05e13b83f0059babc6e867ae8b2a5616ca7cf5fbb564f49304eda0d5bf7c5f89d30a7ea3998dcb2045aa21a3
-
SSDEEP
6144:0TEgdc0YkXAGbgiIN2RSBEnk6mHnUC/5Etqv+yw42UcEtOb8F9fML3d9yfDcTR3i:0TEgdfYubg4k6qu4mywodp+Dmcdi
Malware Config
Extracted
quasar
1.4.0
Office04
77.83.242.206:4782
b50e3441-70f1-40ac-96af-dfb81f08fe1b
-
encryption_key
34EAA505D1DB50EE025558A72F9F26647208F015
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar
Files
-
BF45D2F0B91865FC40060820980C9CF3A02C0CD42788B.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 498KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ