Behavioral task
behavioral1
Sample
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe
Resource
win7-20231129-en
General
-
Target
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
Size
348KB
-
MD5
8436d16727f4b911f5480809103baa87
-
SHA1
50a1b81af0bf85af5a3ef841fe49746675313120
-
SHA256
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
-
SHA512
ae668799e2caca582c437271e7ee51c5d679a64a7dec26e4a31909bf948d6c9f0d467a2d39b625af8471267431adeec70b89513100690c6937aae21e1b6c521d
-
SSDEEP
3072:9FxkhjvK3tFGW8jrQ+G/3NFZLZICSAr0EXZtiNLBPp64PFvqv5bnux7E3MpdMGTE:9LL3HRsM+OFZL2HL7CRbu+8gYdfDIui
Malware Config
Extracted
quasar
1.3.0.0
Client
runderscore00-61208.portmap.host:61208
QSR_MUTEX_q1SPcFNLEQ1FIcq9Po
-
encryption_key
qQYEXzkyhZKvRSzcxALx
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220
Files
-
2dec7d06740585afafca969de80238be1d58bdb8172d45b71b47f3fe9fc9e220.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 345KB - Virtual size: 345KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ