Overview

overview

10

Static

static

10

780-73-0x0...ry.exe

windows7-x64

780-73-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    780-73-0x0000000000400000-0x000000000045E000-memory.dmp

  • Size

    376KB

  • Sample

    221110-lppt3agfg7

  • MD5

    d6eb961c6f21ed380a16b038f3398c64

  • SHA1

    9d1e73584a15a7695ae2a830fbf1ca2a6b396d9e

  • SHA256

    92ff0984cce332ab47068854fc3ced9ff4a64a3c08396cd0303027a25636e862

  • SHA512

    a11e1322cf9f8fddba0c91a4ea3ce339f4fa93e75d03efeaf80e1a25fb7624a948fcc45fa2df7384791bd9d3d262ee7fe22e3c7dca23bde402704402a398e562

  • SSDEEP

    6144:D8NHXf500M+4EFC4KQk7lKxbvY67CACSerymKtwe:Qd50yAQlbCjSerymmwe

Score
10/10
quasartop

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

top

C2

dnuocc.com:64594

www.dnuocc.com:64594
Mutex

QSR_MUTEX_NKzsG6279pND1MmPDw

Attributes
  • encryption_key

    6c7zzdS2IXrGaCb9wrMU

  • install_name

    tors.exe

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    tdm

  • subdirectory

    tilk

Targets

    • Target

      780-73-0x0000000000400000-0x000000000045E000-memory.dmp

    • Size

      376KB

    • MD5

      d6eb961c6f21ed380a16b038f3398c64

    • SHA1

      9d1e73584a15a7695ae2a830fbf1ca2a6b396d9e

    • SHA256

      92ff0984cce332ab47068854fc3ced9ff4a64a3c08396cd0303027a25636e862

    • SHA512

      a11e1322cf9f8fddba0c91a4ea3ce339f4fa93e75d03efeaf80e1a25fb7624a948fcc45fa2df7384791bd9d3d262ee7fe22e3c7dca23bde402704402a398e562

    • SSDEEP

      6144:D8NHXf500M+4EFC4KQk7lKxbvY67CACSerymKtwe:Qd50yAQlbCjSerymmwe

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks