Overview

overview

10

Static

static

10

4304-147-0...ry.exe

windows7-x64

4304-147-0...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    4304-147-0x0000000000400000-0x000000000045E000-memory.dmp

  • Size

    376KB

  • MD5

    b6bf8b6806b5bb6c12ecc8b1858fc46c

  • SHA1

    15098e5ac00f94a4285585ceca0de63b5d167cee

  • SHA256

    c804220b6a91721a2c66b2eafd1fe1e23ca0b1f9ce8a9f8e0e3b0800613e06ae

  • SHA512

    24976dc4350b18732b15d50bbc250d739e5d27ef2d69aa750e8c152941dc8e623e77b43e982328cdbe1a5e904be8fc64bf46b64d2991f912f8559d355d4b6cf3

  • SSDEEP

    6144:5ANHXf500MbfH7NMubc340rCu0GNJPkKZh6:Wd50Nqto0fNJ8K76

Score
10/10
hopquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

hop

C2

dnuocc.com:64594

www.dnuocc.com:64594
Mutex

QSR_MUTEX_gKkre5ge46OKHHYV4m

Attributes
  • encryption_key

    MWS1P9A8h60dOGbuRmwt

  • install_name

    hvc.exe

  • log_directory

    Logs

  • reconnect_delay

    4000

  • startup_key

    hrr

  • subdirectory

    hik

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 4304-147-0x0000000000400000-0x000000000045E000-memory.dmp
    .exe windows x86


    Headers

    Sections