Behavioral task
behavioral1
Sample
$77-Client.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
$77-Client.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$77-Client.exe
Resource
win11-20240802-en
General
-
Target
$77-Client.exe
-
Size
3.1MB
-
MD5
e98e0861177d89b58f60fcef0cb219ac
-
SHA1
2271c6866090e8d7957caaf231c968f9c2623be6
-
SHA256
a235ce344e146142aa0317e7fdfc5748a91981b52cd8f3630afde14094965d9e
-
SHA512
64c9410bc7e8ec34270d8c65a1c1587a903cd146f7190e3bb48c2aa2f363660aa65237032afc5eae9920a793e6a30fb7dfe92c76eb105b0f4033383666991cbb
-
SSDEEP
49152:2vbt62XlaSFNWPjljiFa2RoUYI8ZCq1J0LoGd+1jHHB72eh2NT:2vZ62XlaSFNWPjljiFXRoUYIiCn
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource $77-Client.exe
Files
-
$77-Client.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ