Quan Client.zip
- SHA256 72d46fad621b82e87447d44c1aee2e758193787f71c1327c607c312db0eaa790
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Quan Client/at.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Quan Client/at.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
Quan Client/start.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
Quan Client/start.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
300 seconds
General
- Target Quan Client.zip
- Size 4.9MB
- Sample260710-rhjblaaz2q
- SHA256 72d46fad621b82e87447d44c1aee2e758193787f71c1327c607c312db0eaa790
- MD5 d9230efe83f9bb33dc1352d59ddc3e81
- SHA1 ddc1cdd9f11e057d360bb6c37dfc778fef34546c
- SHA512 5ae6499a3fd8ac3024154cf87ad769397084fd5f02757dda08fc1abae3739d502a72b9eb91ae0def177e172e3fd817d8a4340f05f96430e39a47136ea6413b7b
- SSDEEP 98304:vF9l1BZ361LpCDpxb2fLEjBCy88M/uDrchi4RPayLbT2OKPRM5mNtG3/:dlL3OLpCcyCy88M/wrkPic9SM
- TLSH T1B93633F6C4D3DD921B84B01AEEE0D664C8552719ED3D244C888FFA70B6DA8984E257BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Quan Client/at.mo
File Explorer
-
Quan Client.zip.zip 4.9MB
-
Quan Client/at.mo.exe 5.0MB
-
Quan Client/readme.txt92B
-
Quan Client/start.bat.bat 303B
Quan Client/at.mo
- IMPHASH ff7525133bbc7d3a17cf3a0a573af3d5
- SHA256 3de2d69d3e070bb9f859fbb195f9e3856efad30c576a9fb5d49f38be95a88cf6
- MD5 367b5f178930a6a4a6836ebe8ecf14a9
- SHA1 02a87e7ee725f61154f795769472912ab5eec872
- SHA512 3e72c724d64d21eeb2af51b4c8259ad6fd851f600ecd1eeb024623b4cac52279085c3675aa023e51fc5cf1f50f12b2805b2ff46d7ca0cce0255e2ea0f55cdd7f
- SSDEEP 98304:jad/XVVX6hLlC5XXx23REpjSa8zm3QV9oK31puEZPsKLlT2mXXURX:jif3XQLlIkCSa8zm3HKFzUcvXE
- TLSH T1B23633DAB5C64FD5F41AC3B466D226ECB4683F71C8390C18BDCA6A106F9E92439361DC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12634240
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d9
Direct3DCreate9
kernel32
WaitForSingleObject
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetShellWindow
advapi32
OpenProcessToken
shell32
SHGetKnownFolderPath
ole32
CoTaskMemFree
imm32
ImmSetCompositionWindow
d3d11
D3D11CreateDevice
Name
.text
Size
Virtual Size
870KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
8.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Kv$
Size
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.u|V
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.MA*
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
673B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Quan Client/readme.txt
- SHA256 2f62e62db8cef02236e8fd3b8e2129b354c888603702b12610c6e54b5641f76c
- MD5 8423210e6308149b7eddf9c097430f57
- SHA1 c6e988c63998934c939b35c4abe2fd80d26313af
- SHA512 0d44a48e06a0678027cc47d1a05369158e10a882594a595a0ca1634a36e543e908305ca736ad5c6bae74455f5c56ce9a6249fe4012073fc7a960577afe033d09
- TLSH T102B012D38F0814610E1610D40A4F4B1C008C260D844781553237C4C8180AE2134807C9
- MD5 SHA1 SHA512 TLSH
Quan Client/start.bat
- SHA256 4799771e139e4701ead0b48a7b460b313db3bf5d0199b9cdd9883c10281952a4
- MD5 59663aee6f6d5811a2476cadc4cb5a1a
- SHA1 2b2c043a8689a14c6fe30e23f57bff745fdae71d
- SHA512 850c6d6b90fe89529fb0813734371205f15cebcbf1b8cc32725a3687f175af3af58be1ea9a67f1f2f9aaaf68223917c0e85647eeb3223ceb8ba8fb409eb112c9
- TLSH T1F2E0C28A01076831C1B517F40DF62845DA0DC0432B1AAAD0358EC0C4AF77B6E63C2B84
- MD5 SHA1 SHA512 TLSH