Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.exe
Resource
win10v2004-20240611-en
General
-
Target
Uni.exe
-
Size
348KB
-
MD5
d98814e594224fa06fb9bf4fbfc6ee90
-
SHA1
db74c6e773f5575b9b4b05ae206c21827f9bae57
-
SHA256
85a3c4d50a0e17ddc581206e4ac1a2f1220c16d562d6e894f5068972159ddca0
-
SHA512
3436b3f7c6dc4c7696ccc4d4efaebd9cada8f4d2ee9b711bbe523e26813919fb58a265ea3f3195c45dde3930f2995fc1951e387eab7437198ce060b97fce96ee
-
SSDEEP
6144:UzL3HRsM+OFZcZt3bfTGksNFbp1xzpCSgJuzKkgfzT:CVP+MMsNh97gJuzKkWzT
Malware Config
Extracted
quasar
15.5.0
SeroXen
paris-itself.gl.at.ply.gg:49485
QSR_MUTEX_9sjCnkSDYeXTl5L2qC
-
encryption_key
jKIJSX0QMuirSu2Asapm
-
install_name
$sxr-powershell.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Taskmgr
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Processes:
resource yara_rule sample family_quasar -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Uni.exe
Files
-
Uni.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 345KB - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ