Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e

  • Size

    534KB

  • MD5

    17e6bffaff1ea223913deb1bc78e74ae

  • SHA1

    67daf17f3c8f6d2169b24f9a3698921991bbba2f

  • SHA256

    af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e

  • SHA512

    72086bdd67ce5c778a625d37d7069200747b70193742afee986ec3d58b3a4a5c95b206c91997faf5d3e46e7ab379955db5f033a8b10a4a4899ff6e6068c60ab6

  • SSDEEP

    6144:l8fGABIgrx8kFYLTiMkbMaOcXL/Tb88ASigvCcD+6cfsfiTDpxUKl3Gy3V8/GV0S:EPx7FYPiMNA/flvCcqTsfGpxLl+u

Score
10/10
asdfquasar

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

asdf

C2

checkme12.freeddns.org:1604

Mutex

VNM_MUTEX_yidaALoSEROfTPWHwX

Attributes
  • encryption_key

    TbfVFQWqb0uiZoBjJ9E9

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    UPX

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections