Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
dc3f5eebf8ab3dd6fef8b51610d2c356
-
SHA1
0847d42da980bafd989804386b0889c1ceb5a869
-
SHA256
3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
-
SHA512
03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
-
SSDEEP
49152:bvCI22SsaNYfdPBldt698dBcjHZKxNESE9k/ikLoGdwTHHB72eh2NT:bvP22SsaNYfdPBldt6+dBcjHAxgq
Malware Config
Extracted
quasar
1.4.1
RAT - fake incognito
192.168.4.30:4782
d94dce9f-b2a7-4e68-b727-6888151a6b4e
-
encryption_key
40B0884053AA1A1D9985C8E042F5C321462F78A6
-
install_name
Incognito.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Incognito
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Client-built.exe
Files
-
Client-built.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ