Overview

overview

10

Static

static

10

SecurityHe...ay.exe

windows7-x64

10

SecurityHe...ay.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecurityHealthSystray.exe

  • Size

    353KB

  • MD5

    7a9add7e6f6fa0bd8df9a7ec2b8cfb2a

  • SHA1

    011c64eb4445b1b2e5a4bebcd0aa72e993497e73

  • SHA256

    ee8fe0d59eccb5a8eb288a57e6aea41dc2e5e4c95a25a434fd5e08155f321ea7

  • SHA512

    0702f304f3bbc9a45111dd3069c9799176a8ecc5d97351fddd55f01b472e095602c72e8db813b1ee93017fb122aee2f4670288227a0cf4d7e6f1b6d6ea6c19ac

  • SSDEEP

    6144:OuIDkAT6QSkszJqfj5D4dasv6ursybbIQyeZgoCR85fR7SwXnM:t6iksqDwYUPn5fRS8M

Score
10/10
discord retardsquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Discord Retards

C2

consider-brochure.at.ply.gg:27804

Mutex

QSR_MUTEX_yEihaOvZEzneMMUBSr

Attributes
  • encryption_key

    X5HxVSWdjmOnUtl2t2X8

  • install_name

    SercurityHealthSystray.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SecurityHealthSystray

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SecurityHealthSystray.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections