Behavioral task
behavioral1
Sample
poo virus grr.rar
Resource
win11-20241007-en
General
-
Target
poo virus grr.rar
-
Size
1.0MB
-
MD5
188f727e3be9e5d89c86d843441386f8
-
SHA1
d84ecac02426ab30a66de06c7ec72e52a0eaad6d
-
SHA256
8b507e7ba319bcbf1a13540ec20ad4f31d667a6a1cc99e091fc2f74066123c78
-
SHA512
332358be50280c6005b95fc5fc288ab767abb0162c6f0ddd19fab8e4c5dd22f46ea2f724cac63baaf53086b7d095d04527d55a10796275fc9ecedd0f117c1718
-
SSDEEP
24576:2zGoqxxbY9XIPD7Ltr4ol2iu0kiOiIBIvWCcxdxq:2wxxiXIHLyolt/7DIGvsxd0
Malware Config
Extracted
quasar
1.4.1
Office04
181.99.66.83:4782
7b23506c-ff83-4362-93b4-b99c14429834
-
encryption_key
7A8E2417AD5EAA788488BDF81FE6CACB01258933
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule static1/unpack001/poo virus grr/activate virus [logs ur device].exe family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/poo virus grr/activate virus [logs ur device].exe
Files
-
poo virus grr.rar.rar
Password: 1234
-
poo virus grr/activate virus [logs ur device].exe.exe windows:4 windows x86 arch:x86
Password: 1234
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ