General
-
Target
0x00060000000231ee-21.dat
-
Size
3.1MB
-
MD5
29853d6de2a6ea760788dbdbe601a4ab
-
SHA1
038ee578dca716ebb46d4a96105838d39122d7a0
-
SHA256
ad306c945a71d25faffefb7330f1563ceb100513a4c50fa29fb60b2d46fbd732
-
SHA512
a6c5822ac7899582b6f7b09670a4e8f0f7867d468aa0b321967ed25a8cea0c27e8357b81e3909b61f8ae70f69d4e50f2b68c31f64110c0e6a258efc39f2f9bf8
-
SSDEEP
49152:fvKI22SsaNYfdPBldt698dBcjHDTRJ6wbR3LoGdZTHHB72eh2NT:fvn22SsaNYfdPBldt6+dBcjHDTRJ6K
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Slave
C2
backupcraft.ddns.net:4782
Mutex
fbfe67fd-8086-4852-908c-75959d17c0c7
Attributes
-
encryption_key
6550C5FD133683B3330870C778B7DB73E923F472
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0x00060000000231ee-21.dat
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections