Behavioral task
behavioral1
Sample
3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7.exe
Resource
win10v2004-20241007-en
General
-
Target
3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7
-
Size
2.9MB
-
MD5
5483c37b61b571c15f2d044f6918cf66
-
SHA1
fd2c0199a8ea6975277a8a0a6860246eef06a2a0
-
SHA256
3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7
-
SHA512
d7d688effe0311a15fd3c2c103a1a2e47818e4b79af02ce8d25aac30a857c88f36fee7d01fe96dcbf837a0f4a5a6714ad1bc21521384c83ca953b10015111573
-
SSDEEP
49152:/v2lL26AaNeWgPhlmVqvMQ7XSKKQSYmzwXoGdVf:/v2L26AaNeWgPhlmVqkQ7XSKKQSqx
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7
Files
-
3625dbaccdd40c43f613f6a8934c3da702d599e10758c226e7d8eed1a30206c7.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ