Overview

overview

10

Static

static

10

ZenLg.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZenLg.exe

  • Size

    3.1MB

  • MD5

    0fd3528524db85f882ae9fd20eb235f1

  • SHA1

    3fdf6877acecbce98577da2a0166bff33a41c468

  • SHA256

    15cd752dda3e2d90d7dcff00f25fd979ba61fda28b69dc318670cf139e7b4983

  • SHA512

    a1aca9822284a2484c80e0c5367ca99e854f89772ed3bfeb46e46e1d0662718055e645ebdcf8780306205ce53cc60edb06fd5682830c39ef7080cf6b76f072b0

  • SSDEEP

    49152:uvfI22SsaNYfdPBldt698dBcjHlj8YhZ1vRLo2d2THHB72eh2NT:uvw22SsaNYfdPBldt6+dBcjHlj8YhV

Score
10/10
eeeeeeeeequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

eeeeeeeee

C2

192.168.4.125:4782

Mutex

1cfea801-c253-4326-a0bf-d77f2e0842d8

Attributes
  • encryption_key

    07F6BA1FF60EF8D09B533C1AEC06D037B96FEFA1

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ZenLg.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections