General
-
Target
setup.exe
-
Size
3.1MB
-
MD5
85f1c33bca15aed885f2a211c7a16ace
-
SHA1
4ca79b4c8e8d6a3e7023d94f98c8c4d53e363934
-
SHA256
f6cb09e109a5cbcd9286b293464ee0fa8ca4a846ccc59b0dfa53c114d74b1093
-
SHA512
c319cc1cbd39bc1508288f357c4f7fd9fa907fa5d4377f6b7b9e37e3a76e91fcbf62d989b27019a47c95ee51895a794fb5eb5c6c19a639e2636d4eb8f22f6651
-
SSDEEP
49152:WvyI22SsaNYfdPBldt698dBcjHRmDkE2HNk/+FVoGdvVTHHB72eh2NT:Wvf22SsaNYfdPBldt6+dBcjHRmD2X
Malware Config
Extracted
quasar
1.4.1
Office04
86.9.95.137:4782
d09b8b98-ea9c-49d4-bfd3-04dda7a80cde
-
encryption_key
F26B2A96E9FB88BAB8A8E7F9F9A1630733DE7809
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
windows defender
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource setup.exe
Files
-
setup.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ