General
-
Target
OperaSetup.exe
-
Size
6.0MB
-
MD5
6e9a5eb6cf78a859c57f941b97e1fa15
-
SHA1
8c7fa34eb9536c54bdb49939881a5010cd33eb9b
-
SHA256
ed4cbfe246783bd7a7d124ac8f67e208f968a805264c3c6883fe77ac8fc4e72c
-
SHA512
e8a72ba8b33a480b391a739c2bfef12bbe2e933deb70851de60c940bce353c12dea5070e5ed2d2effc405a9ad49dc62afac23bd1685a27e7f2907bdd72eeba64
-
SSDEEP
98304:jGh5ziNlRUaub+MPDrc/c+NmXnKyFrsqCdvE62XlaSFNWPjljiFXRoUYIB4dB:j3NlqaubXgUCqCRcZYnB
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OperaSetup.exe
Files
-
OperaSetup.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.0MB - Virtual size: 6.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 175B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ