Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    2.8MB

  • MD5

    9d56d156c32dcd12067d8618275a033f

  • SHA1

    f83825d39a358b6d594eef32f8c0cdc9db47fae9

  • SHA256

    531d84e9e1fc539dfc5c65511008d4c7fc4f93b8469f655829ac7d6ae8faa70f

  • SHA512

    3b940752128c201e411805a2e149533e293d98674ecfcf7fe50507f6fb4f83e36cb0f2e7f1ff238139a9e5d261f77a8e79a9aef7c81878223f90cd8268e1eca2

  • SSDEEP

    49152:dDr5rsFM1kNNnAQ7rQeWU8B31o9o2s8Ufsza32ehyfTYBDm:dDFsFM1kNNA6ke/8lW9o26Ba

Score
10/10
rrquasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

RR

C2

vpnnid.hopto.org:4783

Mutex

0a9b2eca-732e-4379-8b97-28c68a1d3204

Attributes
  • encryption_key

    C390E62881F25347C39CDE51024A9C687D49675F

  • install_name

    svshost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft Update

  • subdirectory

    Intel

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • tmp
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections