General
-
Target
17e6bffaff1ea223913deb1bc78e74ae.exe
-
Size
534KB
-
MD5
17e6bffaff1ea223913deb1bc78e74ae
-
SHA1
67daf17f3c8f6d2169b24f9a3698921991bbba2f
-
SHA256
af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
-
SHA512
72086bdd67ce5c778a625d37d7069200747b70193742afee986ec3d58b3a4a5c95b206c91997faf5d3e46e7ab379955db5f033a8b10a4a4899ff6e6068c60ab6
-
SSDEEP
6144:l8fGABIgrx8kFYLTiMkbMaOcXL/Tb88ASigvCcD+6cfsfiTDpxUKl3Gy3V8/GV0S:EPx7FYPiMNA/flvCcqTsfGpxLl+u
Score
10/10
Malware Config
Extracted
Family
quasar
Version
2.1.0.0
Botnet
asdf
C2
checkme12.freeddns.org:1604
Mutex
VNM_MUTEX_yidaALoSEROfTPWHwX
Attributes
-
encryption_key
TbfVFQWqb0uiZoBjJ9E9
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Venom Client Startup
-
subdirectory
UPX
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar family
-
Quasar payload 1 IoCs
Files
-
17e6bffaff1ea223913deb1bc78e74ae.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections