General
-
Target
frivirus.exe
-
Size
1.8MB
-
MD5
22b6ce3fb5468a1a3b815fd49cef9e2a
-
SHA1
eb0e6a30595d33f486a31875ab6987589e62a1cf
-
SHA256
03168b7fc07d7572179b03b923c22200b259d4e01754e3e0df0118206ac9c2b9
-
SHA512
e79723c4e0a62dac02f2f2bcbb487527ad053069e3b6065a13822165173823b4d5b326293ebe99a5c58b1409b33e904415c0816a9d4401f4fdd518d452720530
-
SSDEEP
24576:cl157A4S2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9exnd7XrwSZ:cb5t7wR2EgKKm77LrwCB6TFrwM9
Malware Config
Extracted
quasar
-
encryption_key
F5F31C46BB15BEDDB643667BC441A55E746DE4B8
-
reconnect_delay
0
-
startup_key
��0��c�����ƴ�
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource frivirus.exe
Files
-
frivirus.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 249KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ