Overview

overview

10

Static

static

10

1333.exe

windows7-x64

10

1333.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1333.rar

  • Size

    1.0MB

  • MD5

    d4c5cc7fd074c88bcc59fa38946c6fe3

  • SHA1

    2214408718298c28c95744d09dd47e72a786db44

  • SHA256

    3e53b80db0827b0f969ee3c51dd78ea93bed11e558bd8be5bcf25e75a0174b7b

  • SHA512

    c4a4bfbc6a1878739d177512f815ebc7cf08a787231dea2155c31e216fba4bfbdbccd40a9ba21d20f48ae834f4b9fc8897e37c43e63bb2d8877093f7cba2ce62

  • SSDEEP

    24576:lhELDyMZrZJ5SV6mKw2tLni7HbhE9uS4rSl:lMrZr1meni7Hdpfml

Score
10/10
plexmediaserverquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

plexmediaserver

C2

0.tcp.us-cal-1.ngrok.io:15848

Mutex

02f5fd9d-95c7-4794-a0e7-11efb00da7ec

Attributes
  • encryption_key

    851306CC0F4D0610F45DCF2B644AD7A9121E10E2

  • install_name

    plexmediaserver.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    plexmediaserver

  • subdirectory

    PLEX

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1333.rar
    .rar
  • 1333.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections