Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20250410-en
General
-
Target
Client-built.exe
-
Size
1.5MB
-
MD5
efdf48328fd93af977682db2ac7b56ce
-
SHA1
006abc06af3cdc20dd52588beb5ce4f13273f2db
-
SHA256
dd1ff957df241c8301de5be805cbe9c484a9d3768e657afffc83a0697f881674
-
SHA512
30f723977dd6006954f6fc19c23abf421c11a00845ba9dbbd9a465ce6c7a023f96bc641023a1833605cc0306d1e4a7371cee7e2f31bb755d02c25f548949f8d3
-
SSDEEP
24576:uU1R7bTS2eWBRwRR16zhHIPbcNK0KKm77yviUSQaZaOwI55l2S62r9exnXWiA1Qx:uqRR7wR2EgKKm77LrwCB6T+1Q
Malware Config
Extracted
quasar
-
encryption_key
1FB7485171FF20CDA99F01C1B832D8813FC1E606
-
reconnect_delay
3000
-
startup_key
�&)M-Im�� c�hp����C��.��
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client-built.exe
Files
-
Client-built.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ