Behavioral task
behavioral1
Sample
MusNotifyIcon.exe
Resource
win7-20240221-en
General
-
Target
MusNotifyIcon.exe
-
Size
3.1MB
-
MD5
b352f56fbcd5405d358dd1e1384d5ce3
-
SHA1
86247e2146e096aa077d481d2c0b07e5c9e696d9
-
SHA256
e55136b5e561f22a57a076a0f60643d148d7463464d79e79f5153e007a7161c5
-
SHA512
149a9d1998561d29f648b6a9e4a617f9a862ddf3a2fcbc1b2ac560041529bd45fa83308d7976a3da5cfb170abcdde2f7f744abf8ead7c74a499215ae395e65f9
-
SSDEEP
49152:+v7I22SsaNYfdPBldt698dBcjH4dqHoGdcbfzTHHB72eh2NT:+vE22SsaNYfdPBldt6+dBcjH4dIU
Malware Config
Extracted
quasar
1.4.1
openfire
88.209.197.253:4782
2fa9b0b1-af2c-4d7d-827f-a5590c4a6496
-
encryption_key
CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896
-
install_name
MusNotifyIcon.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
System32
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MusNotifyIcon.exe
Files
-
MusNotifyIcon.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ