General

  • Target

    da2af38db4b5bd416d2be6175630727cd3be73f7d52177e33d2a1da660d62185

  • Size

    3.1MB

  • MD5

    871556e1a93a261d9f942055b47ae9d9

  • SHA1

    c2c8fde536274f8adc0177196fe80644c11edbd5

  • SHA256

    da2af38db4b5bd416d2be6175630727cd3be73f7d52177e33d2a1da660d62185

  • SHA512

    e869cd9d698bf05a7e20fac22177ab167bd956f379759fb2b3af5ed37bf2f636cafcecb4d4766ac9020481b42d1560539fffc2e6c189b752a2bab7d645fddb64

  • SSDEEP

    49152:6vct62XlaSFNWPjljiFa2RoUYIM1SE9oGdBiTHHB72eh2NT:6vg62XlaSFNWPjljiFXRoUYIM1Se

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

spread

C2

adequatelicensing.at:4040

Mutex

d93e662e-a9de-4198-89ca-f18764fe29de

Attributes
  • encryption_key

    36FFB0B8C391E84D40C64F776A2794BCA2549D86

  • install_name

    Updater.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Java Update

  • subdirectory

    Java

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • da2af38db4b5bd416d2be6175630727cd3be73f7d52177e33d2a1da660d62185
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections