Overview

overview

10

Static

static

10

66d2983245...a2.exe

windows7-x64

10

66d2983245...a2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    15912b1f54762b107bb3eb0a3e719158.bin

  • Size

    227KB

  • MD5

    6997c9d40dbf3c0da23b8f87b2ba46a7

  • SHA1

    0b9518064ddb87ab80a0b94f6d5191e70c4514ed

  • SHA256

    9122247d468732fa60c2e4d818c938f26951c0ca394d068a1748b82e1c5bc543

  • SHA512

    960b78e27c7ab8612a33aaffa210507bc5b4e681ed37962a4fbdf263bb643108a8ada52765f91be5d9854e3d0f5740b518bc8b415a5a1a6d71efb488188b4ba8

  • SSDEEP

    6144:iN95GsVc8Z7ho2ZQWfMqQGoYyHVNF3VfTwIks5G+A2:K9EsjteWrQPYUVNFFkIks5I2

Score
10/10
client 1quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Client 1

C2

192.168.49.115:4782

Mutex

34f868b8-bd8f-4422-9f8d-e3335481ce07

Attributes
  • encryption_key

    79B7FDEBDB6D20C0C842F4E8867893249517C6C3

  • install_name

    Example.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    GGQUASAR

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 15912b1f54762b107bb3eb0a3e719158.bin
    .zip

    Password: infected

  • 66d2983245305dc6fc932c8e6b4dee4cd5ff8835d88d848dff02c694a9950ca2.bin
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections