Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    tmp

  • Size

    348KB

  • MD5

    6bd31d02674a8de7f52ce57811f98675

  • SHA1

    31c803e0f2772588e4d0e37b952f06b990284e6c

  • SHA256

    0fd5478ebee0f93e857f417d335005e70c2fb1ea391530c9405bf1f68dd4e5ba

  • SHA512

    0b9143d7a725f7d745749007d7fae10c8b0ed1f7b1211bda9e192e79f1d3a87ce59ef1ae7b255ec30b2d67d0761e16818d6cb4e9c458e4eb4095f56d03e9b553

  • SSDEEP

    6144:Ui6bPXhLApfpcwBuGeH2bU8QeDL/YDh/I+:nmhApJBuH98bfgDhg+

Score
10/10
taskhostdquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

taskhostd

C2

205.185.126.148:666

Mutex

QSR_MUTEX_eKOC3FxUJYmTXUa6V7

Attributes
  • encryption_key

    BXzANUQAMdBgSDlVbjI0

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    300

  • startup_key

    svhosts

  • subdirectory

    subdir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • tmp
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections