Overview

overview

10

Static

static

10

e.exe

windows7_x64

10

e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e.exe

  • Size

    10.4MB

  • MD5

    621c28cd39d9d6f9a3377b8da8a8849b

  • SHA1

    5a025ed5f5baae77496e27fb2996fcb22d67ed40

  • SHA256

    54c1dc44cd458da7ec96343973fa7f350df27517715f41483f9cab748d3a9203

  • SHA512

    b5600b871ac950ec10d7bd0c38bb242a9921b1bccd2dacaa709471475a4c410eb2b43b693e2c18db40349f5c8e15b2c0ee93dde4eb3cbce2f47db880fe48033f

  • SSDEEP

    196608:4nIMYy23CPc/V0VjfJcPE8Yw6QodKh7Ls85JxhVgE+uBd1ub:4nIRyEN08s8Yw6Qg1IgEzE

Score
10/10
quasarredline

Malware Config

Extracted

Family

quasar

Mutex

Attributes
  • encryption_key

  • install_name

  • log_directory

  • reconnect_delay

    3000

  • startup_key

  • subdirectory

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload 1 IoCs
  • Quasar family
    quasar
  • RedLine Payload 1 IoCs
  • Redline family
    redline

Files

  • e.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections