Overview

overview

10

Static

static

10

NEAS.1b5d9...70.exe

windows7-x64

10

NEAS.1b5d9...70.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.1b5d94d555da4d3622c04daa76005670.exe

  • Size

    3.2MB

  • MD5

    1b5d94d555da4d3622c04daa76005670

  • SHA1

    89df45f7477158bb91743bb2bce5e1b4212a1c28

  • SHA256

    e8b4e8fa5772f5844e7ed7bc517a4ef8ff1e834f2016001b46c133eae7c1e4fd

  • SHA512

    3096671308ef71210786d93404cbbdee160a7ee542f8f44b5ca03d8ab506d8b462294d8c0996df7d5c7cf7a18983a443785d5ff7a728c75b08c9cdf023bf3a3a

  • SSDEEP

    49152:NvjvE2H5aweBHPbl6T/yGaqA6/j34rbRDKLoGeIoTHHB72eh2NTw:NvTE2H5aweBHPbl6T/DaqA6/j3410zm

Score
10/10
mieboquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

miebo

C2

tsxrkj.synology.me:4782

dng05vpn.v4.softether.net:14782

dng.dns05.com:14782

douzi.my-wan.de:14782
Mutex

915f5b0f-6a34-4991-ab2a-f46332725843

Attributes
  • encryption_key

    13D07E1CDCAA10C665FE06D1A1007537298BA6B3

  • install_name

    explorer.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    explorer

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NEAS.1b5d94d555da4d3622c04daa76005670.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections