Overview

overview

10

Static

static

10

Device/Har...st.exe

windows7-x64

10

Device/Har...st.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MDFILE02_2023-03-13_04_58_51.zip

  • Size

    181KB

  • MD5

    ce136219c5839f3f997fd692260f45e2

  • SHA1

    d8ad1d7db08d478dc1b6cfa1d9d55b44c85c5392

  • SHA256

    645c67f8e3ecb1b75355291849195dfe38630a197064ff9c944b17eec561ef84

  • SHA512

    4c4b6364da61cd7a115a1d3fdd85f76512f8d47454a731e377acc0253f31bbdd1a515be844be2638fe29a1cf29895c21e0bb26ba8d4ff47b69c404be5f94f758

  • SSDEEP

    3072:EwrfXw/JXODb+FoK1D4Dx4LpFgxWpRi3Nwdae7QO5XVSR2u3Dpf5SG0SW/cLT:Ewrf2tFoKFIxSRi3NQt7DVV61vk/e

Score
10/10
qwazarquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Qwazar

C2

45.8.145.254:5984

Mutex

QSR_MUTEX_6RUI3790thKvUgdQ05

Attributes
  • encryption_key

    H7fYvd6ooQ98IA8qAG3x

  • install_name

    svchost.exe

  • log_directory

    logz

  • reconnect_delay

    3000

  • startup_key

    Svchost

  • subdirectory

    Svchost

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • MDFILE02_2023-03-13_04_58_51.zip
    .zip

    Password: Malware123!!

  • Device/HarddiskVolume4/Windows/SysWOW64/Svchost/svchost.exe
    .exe windows x86

    Password: Malware123!!

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • manifest.json