Overview

overview

10

Static

static

10

1688720644...fb.exe

windows7-x64

10

1688720644...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1688720644c27be01571e4bfb.exe

  • Size

    1.0MB

  • MD5

    bdafdad843fce3ab9f761770015c75e8

  • SHA1

    1081075314281f0eaf74161bd78506e77cf62249

  • SHA256

    ac196722bcc6698fc8ff570dc9d78f6fabcd23c18f889e41f7bba334945cab7e

  • SHA512

    37bd408262391c15e36ed3f0d2c0dbf67ae4f94a1eba9f4834608ac1f4fe39e6b79b42944097579bc6b3cab580be7abbec7029f527ede9fe1f27659cf1f0e1f7

  • SSDEEP

    24576:h/Y5kMJDyGouUqg75HVDBvdrPyKlelwo3xPPqjt:x4kMJDyGouUqg75HVDBvdvlelwo3xq

Score
10/10
operacaodocquasar

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

Operacaodoc

C2

vhf.sytes.net:4783

15.235.109.170:4782
Mutex

jU5VET6hDVfCRgAcd1

Attributes
  • encryption_key

    EbLkm5GEf9Y3fYtXvrtA

  • install_name

    Venom.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1688720644c27be01571e4bfb.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections