Overview

overview

10

Static

static

10

Client-bui...up.exe

windows10-1703-x64

10

Client-bui...em.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    疑似远控.zip

  • Size

    2.2MB

  • MD5

    ae271f9917fcb2d7ffad3015dee5e66a

  • SHA1

    18ed58db4e2b4796d77e8a22efd88266aa4bb3e7

  • SHA256

    528011427ec6ae5a3f73e18b2ee736578248d25499bc637bf1b3cc418d39cece

  • SHA512

    5ef4379d9557898f7cd2691793d9447a8be5f3ac0f552e9783bf7b7ad1b66a1c5275a6a0483f28ea8ddbb0d3adda1f4aa25dc5c82ed2cc5b2fd2fb76383234f3

  • SSDEEP

    49152:nYhxpDJ5jlEzjv4mpqiLZoufKYVdxD57YYzmlW:axlPlEPv4/jMVdxDl5z3

Score
10/10
vmquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

VM

C2

211.101.233.234:1026

Mutex

21ea9163-c47a-4731-8dcb-d1492d3afcd3

Attributes
  • encryption_key

    84C3980D30E4E4331824F949317A7CE7D06D00FF

  • install_name

    vmware-daemon.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    VMware Daemon

  • subdirectory

    VMware

Signatures

  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 疑似远控.zip
    .zip

    Password: infected

  • Client-built-non-install-and-startup.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Client-built-system.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections