Overview

overview

10

Static

static

10

csrss-not-...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    csrss-not-protected.exe

  • Size

    3.1MB

  • MD5

    9860f52d3bf9ce7cb1389c16c97318bf

  • SHA1

    839fa9d755a337e56ba2e6cca077f07c1a3ea55c

  • SHA256

    d6a339ccfc1b0af7b4461871c86f6a21f8228829d482a88fe3be000f558472fa

  • SHA512

    24856002c82547af2797dfe025f78d7d315cfbec8a405b04b7afc299aa6ec1e72058c7d09a408fd55b5331c13c1c4d6edbe1b6f0ef907985310cddf7a5bac3db

  • SSDEEP

    49152:evNt62XlaSFNWPjljiFa2RoUYIxRRJ6mbR3LoGd62THHB72eh2NT:evv62XlaSFNWPjljiFXRoUYIxRRJ6g

Score
10/10
userquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

user

C2

bore.pub:3434

Mutex

dea7d3ac-9cbe-4676-9d9b-fbb7abd72f66

Attributes
  • encryption_key

    750E471A2736E4EC77FD37E3C73FCB548A7C773A

  • install_name

    csrss.exe

  • log_directory

    Logs

  • reconnect_delay

    10

  • startup_key

    Client Server Runtime Process

  • subdirectory

    F2D1CC.tmp

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • csrss-not-protected.exe
    .exe windows x86

    Password: test444

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections