Behavioral task
behavioral1
Sample
SLC.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SLC.exe
Resource
win10v2004-20250129-en
General
-
Target
SLC.exe
-
Size
3.1MB
-
MD5
2c56b24a18d5432ed532e86810a26ffd
-
SHA1
3dec2f4e0b2cd11847d777bda2c200372992bf31
-
SHA256
b43e4546cb3217813def9ed74d6a4ff2bd4834b45db07f028224651fe6f51e2a
-
SHA512
3adf96c5acf2c4fcb2bd97f892b6ca8c9f9d22f1213e893499ad5482dfa23369fcf65fc1ad3267677907abd15839f95da439e7eca76b70225b4f1d33337ac852
-
SSDEEP
49152:VvEt62XlaSFNWPjljiFa2RoUYIP08I5oGd:VvY62XlaSFNWPjljiFXRoUYIP08a
Malware Config
Extracted
quasar
-
reconnect_delay
30
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SLC.exe
Files
-
SLC.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ