Overview

overview

10

Static

static

10

780-73-0x0...ry.exe

windows7-x64

780-73-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    780-73-0x0000000000400000-0x000000000045E000-memory.dmp

  • Size

    376KB

  • MD5

    d6eb961c6f21ed380a16b038f3398c64

  • SHA1

    9d1e73584a15a7695ae2a830fbf1ca2a6b396d9e

  • SHA256

    92ff0984cce332ab47068854fc3ced9ff4a64a3c08396cd0303027a25636e862

  • SHA512

    a11e1322cf9f8fddba0c91a4ea3ce339f4fa93e75d03efeaf80e1a25fb7624a948fcc45fa2df7384791bd9d3d262ee7fe22e3c7dca23bde402704402a398e562

  • SSDEEP

    6144:D8NHXf500M+4EFC4KQk7lKxbvY67CACSerymKtwe:Qd50yAQlbCjSerymmwe

Score
10/10
topquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

top

C2

dnuocc.com:64594

www.dnuocc.com:64594
Mutex

QSR_MUTEX_NKzsG6279pND1MmPDw

Attributes
  • encryption_key

    6c7zzdS2IXrGaCb9wrMU

  • install_name

    tors.exe

  • log_directory

    Logs

  • reconnect_delay

    5000

  • startup_key

    tdm

  • subdirectory

    tilk

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 780-73-0x0000000000400000-0x000000000045E000-memory.dmp
    .exe windows x86


    Headers

    Sections