Behavioral task
behavioral1
Sample
b7edc8206134842f1452de2fcc1604b40a078d75a2a56391fc5698aef9fc9240.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b7edc8206134842f1452de2fcc1604b40a078d75a2a56391fc5698aef9fc9240.exe
Resource
win10v2004-20230220-en
General
-
Target
304034ca275b3be98d1b92d28a7ed71a.bin
-
Size
488KB
-
MD5
687a3bab6a3a20a166783803bb8c2a5f
-
SHA1
67138fe94c70596d6d1a7650a6b649c4f90572fb
-
SHA256
4492a8c1335a3be8cfc262b5beab0edf199348cb601961ed422e6e82d628b52d
-
SHA512
c01ecfb0dc15271aa105a8ee59784f9953a4db6a502e311ab3229931e05498e5cdddde900317833fc5553d0dab95d85e4cbb0a4b148fe975f03fdfb6b7b22466
-
SSDEEP
12288:SVqjBmw+AO1aqx6lEWTZAGKyrEgYZFDJ2rFZ:UqjkR1aYCZAGKuEjN2D
Malware Config
Extracted
quasar
2.7.0.0
Venom Client
crazydns.linkpc.net:26134
JlYM51eW4iZoFyLa2X
-
encryption_key
dRPxHr2NcM6jte8WN3KY
-
install_name
Venom.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/b7edc8206134842f1452de2fcc1604b40a078d75a2a56391fc5698aef9fc9240.exe family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/b7edc8206134842f1452de2fcc1604b40a078d75a2a56391fc5698aef9fc9240.exe
Files
-
304034ca275b3be98d1b92d28a7ed71a.bin.zip
Password: infected
-
b7edc8206134842f1452de2fcc1604b40a078d75a2a56391fc5698aef9fc9240.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ