General
-
Target
Ransomware.exe
-
Size
502KB
-
MD5
b08b88db0f73d88e352f98f1a7c1fb5f
-
SHA1
d7eca5fbb92029917ab56672689f809aa06e6a20
-
SHA256
77f05c3fa5092f7583c9f747ce1ecf696be2cbe0aff3e9c974b73693ef3b172e
-
SHA512
4e1281bc2431d9a13bd5ce967a39d8a3c264b6d465c67bf2f8212cc075eb89444f5d946f9b3b0e72d85ceb81800117c107389980b131d879f70c3182f9a5db7c
-
SSDEEP
12288:kTEgdfYzbgpTU03c4nywOcpXQRsnRcdr:pUwsXxywOcpXmsRcdr
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
ActiveDirectory
C2
193.149.176.156:8080
Mutex
84609ecb-d94d-40c4-85ff-8b3191e9d5f0
Attributes
-
encryption_key
936C784DF6BFBCB86D89EDF1DA8425E6D70DCFBB
-
install_name
explorer.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender
-
subdirectory
D3SD
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
Files
-
Ransomware.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections