Behavioral task
behavioral1
Sample
sp0ofer.exe
Resource
win7-20240221-en
General
-
Target
sp0ofer.exe
-
Size
3.1MB
-
MD5
c5dc60ebad720c8a08e21c08db1d2dfa
-
SHA1
268f1aace8a48248d58de344bd1dfd2eb5e2c2a8
-
SHA256
cbac5d6488d2b1655aff14f498060b3a0f752bc26291a34c39ff76da2866de9a
-
SHA512
9930d8208b8bba24bd0d70d9491a302c8efefea5ff195711eee0f725f39b83070e624474de990cd0dc14c80ba0bd27a343cfc31fcee4104e49a76e637cd829f7
-
SSDEEP
49152:DvulL26AaNeWgPhlmVqvMQ7XSKPPxNESEfk/ioLoGdfxTHHB72eh2NT:DveL26AaNeWgPhlmVqkQ7XSKHxCG
Malware Config
Extracted
quasar
1.4.1
Office04
pringelsy-53072.portmap.host:53072
6dc28d35-3024-44a7-a559-f9991015fa39
-
encryption_key
3107DF2D44BB6914C55BEA57D100135AB0F278DF
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
799
-
startup_key
Quasar Client Startup
-
subdirectory
Common Files
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource sp0ofer.exe
Files
-
sp0ofer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ