uni.zip
- SHA256 c4f4b783e9b152a00d5cac8b82d2ae0c74fa848aaa4a524dc5cb81b1576aaab5
Overview
overview
10Static
static
10uni/Uni - ...2).exe
windows7-x64
10uni/Uni - ...2).exe
windows10-2004-x64
10uni/Uni - ...3).exe
windows7-x64
10uni/Uni - ...3).exe
windows10-2004-x64
10uni/Uni - ...4).exe
windows7-x64
10uni/Uni - ...4).exe
windows10-2004-x64
10uni/Uni - ...5).exe
windows7-x64
10uni/Uni - ...5).exe
windows10-2004-x64
10uni/Uni - ...6).exe
windows7-x64
10uni/Uni - ...6).exe
windows10-2004-x64
10uni/Uni - Copy.exe
windows7-x64
10uni/Uni - Copy.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
uni/Uni - Copy (2).exe
Resource
win7-20240221-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
uni/Uni - Copy (2).exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
uni/Uni - Copy (3).exe
Resource
win7-20240508-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral4
Sample
uni/Uni - Copy (3).exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral5
Sample
uni/Uni - Copy (4).exe
Resource
win7-20240221-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral6
Sample
uni/Uni - Copy (4).exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral7
Sample
uni/Uni - Copy (5).exe
Resource
win7-20240508-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral8
Sample
uni/Uni - Copy (5).exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral9
Sample
uni/Uni - Copy (6).exe
Resource
win7-20240419-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral10
Sample
uni/Uni - Copy (6).exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral11
Sample
uni/Uni - Copy.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
300 seconds
General
- Target uni.zip
- Size 1.3MB
- Sample240602-gz5wtadd81
- SHA256 c4f4b783e9b152a00d5cac8b82d2ae0c74fa848aaa4a524dc5cb81b1576aaab5
- MD5 9aab0849ef0117f014b49899edd2e082
- SHA1 4e33c7a81a7a68cdb426b2b76fc3641c03b68fb4
- SHA512 fef8fca946ec4638353730e9a183717c7631c0257899760fbd58b758481ebe6a7020f68c9f8c6eb8c5ab03febc90256fa48afecd230320faa8bac8b7163d595e
- SSDEEP 24576:UEzkWPJeBnqQEzkWPJeBnq3EzkWPJeBnqSEzkWPJeBnqJEzkWPJeBnqcEzkWPJex:UEzkWIcQEzkWIc3EzkWIcSEzkWIcJEzQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
3.1.5
Botnet
-
SeroXen
C2
-
panel-slave.gl.at.ply.gg:57059
-
panel-slave.gl.at.ply.gg:27892
Mutex
-
$Sxr-rpL8EItHN3pqIQQVy2
Attributes
-
encryption_key
Lme7VBS3l58VwLM69PNM
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
SeroXen
-
subdirectory
SubDir
Signatures
- Quasar family
- Quasar payload 6 IoCs
resource yara_rule static1/unpack001/uni/Uni - Copy (2).exe family_quasar static1/unpack001/uni/Uni - Copy (3).exe family_quasar static1/unpack001/uni/Uni - Copy (4).exe family_quasar static1/unpack001/uni/Uni - Copy (5).exe family_quasar static1/unpack001/uni/Uni - Copy (6).exe family_quasar static1/unpack001/uni/Uni - Copy.exe family_quasar - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/uni/Uni - Copy (2).exe unpack001/uni/Uni - Copy (3).exe unpack001/uni/Uni - Copy (4).exe unpack001/uni/Uni - Copy (5).exe unpack001/uni/Uni - Copy (6).exe unpack001/uni/Uni - Copy.exe
File Explorer
-
uni.zip.zip 1.3MB
-
uni/Uni - Copy (2).exe.exe 409KB
-
uni/Uni - Copy (3).exe.exe 409KB
-
uni/Uni - Copy (4).exe.exe 409KB
-
uni/Uni - Copy (5).exe.exe 409KB
-
uni/Uni - Copy (6).exe.exe 409KB
-
uni/Uni - Copy.exe.exe 409KB
uni/Uni - Copy (2).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
uni/Uni - Copy (3).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
uni/Uni - Copy (4).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
uni/Uni - Copy (5).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
uni/Uni - Copy (6).exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
uni/Uni - Copy.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
- MD5 b70fdac25a99501e3cae11f1b775249e
- SHA1 3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
- SHA512 43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
- SSDEEP 12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai
- MD5 SHA1 SHA512 SSDEEP
-
Quasar payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
423134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
405KB
Virtual Size
405KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ