Behavioral task
behavioral1
Sample
3516-173-0x0000000000400000-0x0000000000510000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3516-173-0x0000000000400000-0x0000000000510000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3516-173-0x0000000000400000-0x0000000000510000-memory.dmp
-
Size
1.1MB
-
MD5
a30c1f55b3f0f0b47a61f81e7436527b
-
SHA1
68320cb5a032740a664c956bf9aae5ba001e10fe
-
SHA256
080d9530a134ef3224585de118af9d62bf09e9e5f25f221829e2606817425c61
-
SHA512
91f34b477782e60b4853151da193c8c8fa4f2f052547afe1a729b76c6abc64730ac4f134d9457bf87a8da8e6a3ba8e845c2026f116eb75593f531b4bd9f1f3c9
-
SSDEEP
12288:Zk2ftY5kMJDyGouUqg75HVDBvduzTYTTuzikbSNDC/Nplg36up5cd7Ubl:Z/Y5kMJDyGouUqg75HVDBvdcXNplkTl
Malware Config
Extracted
quasar
2.7.0.0
OP23
vhf.sytes.net:4783
15.235.109.170:4782
2vrOj8wCud9msk5z8w
-
encryption_key
ywxbR3BS4B6Rtb7nv9vB
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3516-173-0x0000000000400000-0x0000000000510000-memory.dmp
Files
-
3516-173-0x0000000000400000-0x0000000000510000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ