Behavioral task
behavioral1
Sample
svhoste.exe
Resource
win7-20240903-en
General
-
Target
svhoste.exe
-
Size
502KB
-
MD5
a9c9735f6e34482c1cdd09e347a98787
-
SHA1
6214e43cdc3fd17978955abf9c01a8d8c3ea791e
-
SHA256
533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc
-
SHA512
084b40e683d88e8eda7a60047f1a640310455986629a63382b3b6ffa6a91f295b47963e2ba52115cb113f57f1f727f2adb98f910a9adca1596af242f266b4a50
-
SSDEEP
6144:sTEgdc0YeX1uRabMR0FdOWbYZTR9UbGzcEKVb8F9ywLlqlHcTR3t:sTEgdfYzRa9uza6FL4lHcdt
Malware Config
Extracted
quasar
1.4.0
Target
127.0.0.1:6070
affasdqa.ddns.net:6070
haffasdqa.duckdns.org:6070
670d21b7-71ed-4958-9ba7-a58fa54d8203
-
encryption_key
25B2622CE0635F9A273AB61B1B7D7B94220AC509
-
install_name
svhoste.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svhoste
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource svhoste.exe
Files
-
svhoste.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 498KB - Virtual size: 497KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ