Overview

overview

10

Static

static

10

csrss-not-...es.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    csrss-not-protected-resources.exe

  • Size

    3.1MB

  • MD5

    e34c3986d1e1769e122ca2af33608da9

  • SHA1

    6378ff2113ad0c526e899a7abff1760bc074035c

  • SHA256

    a2346fdced268345ce610be97b1e7cb0d732d4e8d8f9bb2f77f8ee82200b22de

  • SHA512

    8e74c35ab9e16eef627b2d2af2fe2356da27190999808939a4f6df9b8165130092d71b9d25fe3cdb93875ee8ffb05e483e9b871d7bda3b6160e2b15a73b22f5a

  • SSDEEP

    49152:PvUt62XlaSFNWPjljiFa2RoUYIPxHEak4k/LosoGdfMTHHB72eh2NT:PvI62XlaSFNWPjljiFXRoUYIPx8X

Score
10/10
userquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

user

C2

bore.pub:1337

Mutex

af16ae86-0b48-4284-9e98-38f2d9e86c1b

Attributes
  • encryption_key

    750E471A2736E4EC77FD37E3C73FCB548A7C773A

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client Server Runtime Process

  • subdirectory

    F2D1CC.tmp

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • csrss-not-protected-resources.exe
    .exe windows x86

    Password: test4214124

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections