Overview

overview

10

Static

static

10

181A0E4AA2...F2.exe

windows7-x64

10

181A0E4AA2...F2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    181A0E4AA241E1BF7DA338760918724D3D1FB8FE828F2.exe

  • Size

    2.8MB

  • MD5

    dd84aa4ff3f94ea6afdf6b7fe12600e5

  • SHA1

    8af56530db88221d65daa70877f34dd97dcddea5

  • SHA256

    181a0e4aa241e1bf7da338760918724d3d1fb8fe828f2aab6adbceb6e9c1aeb0

  • SHA512

    db3d4d877391980f7c46143bdaa7b97ca9bec9fb0149f2f64050987a014cf928779cedc1cbef50bafd69c50965d5ffe60ffb9a5e77e97ec39d9fd8cff44ae963

  • SSDEEP

    49152:N0qxOidcA4LQnmA+cfjm+OIJC54WHpnf32Ufbza32ehyfTpm:N08OidcA4LWZ+cfjm+OIJC54WHpm

Score
10/10
hs user1quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

HS USER1

C2

160.20.145.136:3392

Mutex

634667be-7ca3-404f-af10-57cf374294f7

Attributes
  • encryption_key

    AD04514444AA971BC84C16E6C00E575BE0588D93

  • install_name

    MSVCR140.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    MSVCR140

  • subdirectory

    C:\ProgramData

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 181A0E4AA241E1BF7DA338760918724D3D1FB8FE828F2.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections