Overview

overview

10

Static

static

10

3612-79-0x...ry.exe

windows7-x64

10

3612-79-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3612-79-0x000001E86B900000-0x000001E86C166000-memory.dmp

  • Size

    8.4MB

  • MD5

    a1e49d45ddab33f6cf6758688bfd09c2

  • SHA1

    ba0717e661f36acf24c06591c6cf5075f202ec26

  • SHA256

    3a63c027238130afc50be6b429c8224418e48ccd73b486a44e3231a528c87039

  • SHA512

    5b5bc6b8c0c8524515c3ece112cbcd8d6079cdf944b4c824cff2a6d7aa8d5f35b07ebf523ad88140f6a2ce76ea7f20e1d3c2d1ef6437bf5bea3ca64d669339d9

  • SSDEEP

    98304:l6G0UT5A3L1m6qClTlT9RXhtIU+ara74wWmVmUYMvvwkpOwhx/cxmnxK3fABocki:l6GD6vdLXhtI427GyYSZpxhxExEo3f5

Score
10/10
ratv2.1.3 | seroxenasyncratquasar

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.1.3 | SeroXen

C2

supply-dressing.gl.at.ply.gg:43425

buy-positioning.at.ply.gg:58563
Mutex

faab7ba6-5935-498d-9629-58f1913a65cb

Attributes
  • encryption_key

    045F98A287DD47B8B5C074D234995A2C5A913042

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    1000

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 3612-79-0x000001E86B900000-0x000001E86C166000-memory.dmp
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections