Behavioral task
behavioral1
Sample
Helpertask.exe
Resource
win7-20231215-en
General
-
Target
Helpertask.exe
-
Size
2.8MB
-
MD5
62be604349ff7f6efcaa163f2ccdfb06
-
SHA1
e9c5420cfd65c201b054ad55939474cba4ee502e
-
SHA256
15d27a6eed07fe1747835df49e88fd803cdb0518761a4eafc11c694b5a87ecb9
-
SHA512
41e48fa13b6f54f6274e21315f02414c09f22d3e1b9a05f29c5b22edde3763d9160723d3205be3d1bf284be5871414aefe0bfe9029c5fdfa3d4b7e14309fffea
-
SSDEEP
49152:l0phDQQGj33SmdY5sKfLeG2QRaLaOHb9sE0zf9mFDjUf70Bza32ehyfTqm:l0XQQGj33SGmsKfLeG2QRaGO79sE0zfs
Malware Config
Extracted
quasar
1.4.0
USB1
91.92.254.14:4412
0d9c3d70-3dc7-4c2d-9996-9d628f6fc313
-
encryption_key
EB31E9096E1A340FBDBFC8A95E97FE21CC8DAE0F
-
install_name
Client.exe
-
log_directory
System2FA
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables containing common artifacts observed in infostealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_GENInfoStealer -
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Helpertask.exe
Files
-
Helpertask.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ