Behavioral task
behavioral1
Sample
BoostBot.exe.bin.exe
Resource
win7-20240419-en
General
-
Target
BoostBot.exe.bin.exe
-
Size
409KB
-
MD5
404ab800bbe49c36bd64d0d73600b59a
-
SHA1
4c8dff2702fada108f7477ad357067310b584366
-
SHA256
5465f02f24ee5c1fc9c9c27c86c209eeddc2ed607143e1b76ca9c9d9b7b84154
-
SHA512
d0ecd88adfd84d9d8e845281e0437368aadf3d1d6fb704d7c7630d1360697471c2a49584f968eeebd5b435f11af9ce3d06327f1835fa5d07a140f22c0f95fc11
-
SSDEEP
12288:dpyJcC+xB0XbJQtlQDFuYAbtP6j8fXx7EBI:zwd+QJQbQYbl6Ivn
Malware Config
Extracted
quasar
3.1.5
RPad
even-lemon.gl.at.ply.gg:33587
$Sxr-okPqrmZ8kNVUcS4Rp0
-
encryption_key
XmcBnPuLlN1e8SHIRR1z
-
install_name
$sxr-powershell.exe
-
log_directory
$SXR-LOGS
-
reconnect_delay
3000
-
startup_key
$sxr-powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource BoostBot.exe.bin.exe
Files
-
BoostBot.exe.bin.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ