Overview

overview

10

Static

static

10

Rusher Hac...er.exe

windows7_x64

10

Rusher Hac...er.exe

windows10-2004_x64

10

Rusher Hac...er.exe

windows7_x64

10

Rusher Hac...er.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08fb091d9d284795239c1ffd5f06f339b8b6db726198f5325f4ae55c77199402

  • Size

    798KB

  • MD5

    99ecc057418a2cb4973f91b94fcc3aa2

  • SHA1

    d0db89df21526c8da958112040e8370d8fd2f2b3

  • SHA256

    08fb091d9d284795239c1ffd5f06f339b8b6db726198f5325f4ae55c77199402

  • SHA512

    7addf85566e779271189de062b1b852001f908efc6a6cc7b8c8b1f0cf6850241e4a7609945f73391b42be1d89f8a359e99ba886d3667b1dff42197ff5c45ba9c

  • SSDEEP

    24576:S1qO3fmOet6/11hUpsGBoKeDermjHKwHChRH/RK:SL3OO5JUspermj/HyRH/RK

Score
10/10
$77systemtelemtryquasar

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

$77systemtelemtry

C2

192.168.0.44:80

67.61.188.107:80
Mutex

VNM_MUTEX_OplgS6EDrflEgnBXyU

Attributes
  • encryption_key

    tfNbPwosWP6IOHXzQKKG

  • install_name

    windowsrc.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Registry Handler

  • subdirectory

    bin

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload 2 IoCs
  • Quasar family
    quasar

Files

  • 08fb091d9d284795239c1ffd5f06f339b8b6db726198f5325f4ae55c77199402
    .zip
  • Rusher Hack/Data/Installer.dll
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Rusher Hack/RusherHackInstaller.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections