Overview

overview

10

Static

static

10

F34F7D8F94...EC.exe

windows7-x64

10

F34F7D8F94...EC.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    F34F7D8F9488CE6E2438C88F64D262B0529A25519C3EC.exe

  • Size

    502KB

  • MD5

    797722758bc54671176f4ae1894e403a

  • SHA1

    5cac11545515f1452614297a41e18411f083eac6

  • SHA256

    f34f7d8f9488ce6e2438c88f64d262b0529a25519c3ecb947fa28147a81507d8

  • SHA512

    dac39d79388f8d39ebc894f10a33683daead08f658ab3eae9eb969dc21c3b469d05f078a9b36ae12aebb019cbe3f15e203fe6ee24a706ac62183b2b251ab1938

  • SSDEEP

    12288:PTEgdfYvdo6ngiDp4kyw5mpG4W8UecdT:4UwVH/pyw5mpOEcdT

Score
10/10
ctfmonquasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

ctfmon

C2

firewall.trustedvpnservices.com:39583

Mutex

3b144aca-60f9-4bcb-b4a6-716e4a5e2f1c

Attributes
  • encryption_key

    3237D2016D901477C3F2D8FDF94D0482E3E52621

  • install_name

    ctfmon.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    ctfmon

  • subdirectory

    Microsoft\Windows\Start Menu\Programs\Startup

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • F34F7D8F9488CE6E2438C88F64D262B0529A25519C3EC.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections