General
-
Target
Uni.bat
-
Size
409KB
-
MD5
f8f7e612c70c0cfb734e0a8b47ecff5a
-
SHA1
55daed611f6a5d7f3e46b6ad1c1ef125fe7ab37d
-
SHA256
baa1d7de5d93fade36fa20d98d3c0466198a129bebd17302f5f5d8ae03779bda
-
SHA512
38300f170b9464098312f36ae2e43d510dfd7ec6508f29fd50dd6dd65c1ba64804e4d341eb31f49b816383e4cb80d8ae1bf4ab3de6829acc0ca4e9148c970233
-
SSDEEP
6144:zMu9p1kREG60oljWsIgingBbx7SxSphehObnD4xZEzLkf2HOZzkShh1jFJVY/:VpiREGJtsIgith5xKvkf2uZzDPjFc/
Malware Config
Extracted
quasar
3.1.5
slave
looking-memphis.gl.at.ply.gg:45119
$Sxr-xwY9ZOTOHsQiE2cIYc
-
encryption_key
BkqeT44kDiMZNIFpwpqf
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Uni.bat
Files
-
Uni.bat.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ