Behavioral task
behavioral1
Sample
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe
Resource
win7-20240729-en
General
-
Target
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe
-
Size
79KB
-
MD5
8931b2ac2268f43be3b1802fdf106bc0
-
SHA1
d137c943c0b7299660f9cc0a2acdf31c5170fdf9
-
SHA256
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2
-
SHA512
79ab861ee50995466bc1c944e7567230815575ab4b2392712958d8dffd51cebbac553d578ddb1552edd99a4a34c83f8ae386c4761c02ffaffb0e0eba0d6d0ee5
-
SSDEEP
1536:h9JC+t06xgFp7fNbW07sQ4AmejEuEEQtlbrqVF7Hsecx:rAwwp7fNC04Q4TKTAlbr8F7Hsx
Malware Config
Extracted
quasar
1.3.0.0
newVic
recoxxx.work.gd:3000
QSR_MUTEX_qAzzUei5mlwzbguQm2
-
encryption_key
xoLtUvoRon1EOl12Z4l0
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe
Files
-
c19bdcef97bc50e5f3f257f79e3fd19006c8cc0be0f8d3af32f8fa23361b63c2N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ