Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    2.8MB

  • MD5

    a73e083297e46d8e23f012d66a08f3a3

  • SHA1

    83527df5a484494894ad2c71908a170a115751af

  • SHA256

    0ef4667fb2bd5b2184048913181bd7b03bf63d0e7959214b879efa4d6b75ad5d

  • SHA512

    78c2231eb48ed1f246b960b1afbd2b6b1c9b99495b2a1e8b45ea1aa90a21fbd23fd10223dbc7eba9aa057b5932290e20cdcfe2df583b1a93d2cea2bf350495f2

  • SSDEEP

    49152:SHXKqPIxP2ayFJafBpT8m0f50tfmtza32ehyfTgy:SHnP8P2ayFEZKm0fX

Score
10/10
skynetquasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

SKYNET

C2

173.225.115.99:7702

Mutex

938cda17-a814-4925-8420-83a35a350164

Attributes
  • encryption_key

    F04A75E6507173FAEEC2BB82C564030A5E8413FF

  • install_name

    FileHistory.exe

  • log_directory

    Logs

  • reconnect_delay

    4000

  • startup_key

    FileHistory

  • subdirectory

    FileHistory

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • tmp
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections