Behavioral task
behavioral1
Sample
solara.exe
Resource
win7-20240220-en
General
-
Target
solara.exe
-
Size
3.1MB
-
MD5
9c9e1009cf33ab0f1652ccd8a5f845c1
-
SHA1
42d9282a9443175c4f64a7fce83fb39878aa6600
-
SHA256
85d92e5e062b2e847e0334ed5afef5e7ff708e87ba6f25e31be00a0570827b98
-
SHA512
89f3bd5700024260e82369e97c43a6a82a10bc5a7330f0b73dd3c53037e4aa8f9e535727feb58df2e8c54ec48ac9a397dadc49cf1f7cfeaffa00134714e80118
-
SSDEEP
49152:SvtI22SsaNYfdPBldt698dBcjHDPRJ6/bR3LoGdSTHHB72eh2NT:Svm22SsaNYfdPBldt6+dBcjHDPRJ6R
Malware Config
Extracted
quasar
1.4.1
consis
192.168.0.75:4783
7c58e842-ae6e-4f79-bca8-c40fc05002b5
-
encryption_key
3F4E1662FE86BE65EF2C4E1F0FEFAABC94765DDB
-
install_name
Sub-1.exe
-
log_directory
Logs
-
reconnect_delay
1500
-
startup_key
Quasar Client Startup
-
subdirectory
Windows
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource solara.exe
Files
-
solara.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ