Overview

overview

10

Static

static

10

hehe.exe

windows7-x64

10

hehe.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    hehe.exe

  • Size

    502KB

  • MD5

    6ee1d4cdac1ab6bd430563ef2744a0e0

  • SHA1

    7c4c04fac3845c0830fb20408216245cbab36b75

  • SHA256

    4608b4713949ef85961456e190489e97cfe6c5a888ae25e39694941aaf0ec40e

  • SHA512

    81600300d83127a5b7414ebf25c2b0ac50ffa30682c849c7c69bf736c60b32ceef2a2ea17563d3e4b0bb9aa668204a987a6578ede5b3efbe99ce4daeab1ba7c6

  • SSDEEP

    6144:tTEgdc0YsX7IxUpGREWWcpzZjGGLFGnuTNSclcEQeb8F9ABY8i6cTR3O:tTEgdfYpxUxczFdPAZLp6cdO

Score
10/10
sleepyratquasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

SLEEPYRAT

C2

10.0.0.1:4782

Mutex

490abaec-6b52-42d5-b88c-3f3b7b09986a

Attributes
  • encryption_key

    23CA7A0B699C15B2AA46FB0F5B28B82D0CBF1F23

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • hehe.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections