Behavioral task
behavioral1
Sample
eclipse executor/eclipse executor.exe
Resource
win7-20241010-en
General
-
Target
eclipse executor.zip
-
Size
1.2MB
-
MD5
ef28e032613646978bcb9219e5a490c9
-
SHA1
539a9c11014f6d0341a44348ac059da0649dc138
-
SHA256
78c3578aa894e56a27efeaa4daa26b2effd9e90a3ffaa32abea06f78e19ba735
-
SHA512
9bfb694ed46ff4609e2a06600f1d643be478a0f744bb6c42c6fa292e7f13214b6b2ddf34b1253e74013155c53864473b50ad14f297aa8f1fcb047cdc42428536
-
SSDEEP
24576:mdWpNNMHjlvOSQ57JhMIfDAFq46yQj1gq9zvJcX5O93LyPOQNb53XiFG:julk7JhMWsYWae/h53XiFG
Malware Config
Extracted
quasar
1.4.1
made
2001:569:7e70:6a00:c8f3:749c:278f:2c17:4782
9d96368e-1352-46e3-8281-8f5eaf945edb
-
encryption_key
AF603C3CFA231D1BD841E315C27377C7E4A49333
-
install_name
client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Java startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule static1/unpack001/eclipse executor/eclipse executor.exe family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/eclipse executor/eclipse executor.exe
Files
-
eclipse executor.zip.zip
-
eclipse executor/eclipse executor.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ