Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
General
-
Target
Client-built.exe
-
Size
369KB
-
MD5
905b52f7e66b196e5723282d566e7238
-
SHA1
60b0dc7e45122b897582d8a127b9f51152fe2137
-
SHA256
c3114016473515ac92ab688e1d81ef32cd7dc1104f8ce0b23a10de5804335778
-
SHA512
89c4c30ecb2412e2443bf496697f82e0eeb1d78bcf9946e1bd6a96999372adf878a9e36374a1c8347ae1d55f6b27c1f93b1ddaf22d5c3cf9e6d35b9478bd5ff9
-
SSDEEP
6144:veiHHHjGvfAkOCSQzRMhfZDFXqJYQH2Cavvj6F8l3bXlzcpALdxl9Y9FG:veSnjGnAkOCSQzRMhfZ5qGz6F8dlzcQ9
Malware Config
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client-built.exe
Files
-
Client-built.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ