General
-
Target
Client.exe
-
Size
535KB
-
MD5
3075e2435ba7bbedbb120477e9b47471
-
SHA1
c27d4301b4450df914375e506cdc3e5a1d1fcf3c
-
SHA256
059bced5efb7c7caf791345a4c42b3fce77c43f8dbf61cca312e22df51fd2560
-
SHA512
fa03201b43b7252cccdf8b9a3e645e136b01efa777c813672933041561e6ed748a6e6f74a7f18a1bf70ba4a6efe3ab487297979e293d0b5b3dbeee7daae51a3f
-
SSDEEP
6144:9aq44jScQ1zqCqtI6B0xUl7Pq4HxOSMbKTy0/AGW:sq44jUzwtI6Kxkbq+zy0/AGW
Malware Config
Extracted
quasar
-
reconnect_delay
5000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client.exe
Files
-
Client.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ