Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    0b48348f248ad878bb192e62b8b6c06d

  • SHA1

    5977f8e9b936da3ab5e15caa71a5f5aa7d6df889

  • SHA256

    e119c958afe99b8ac81ea6dcf3e8eedc94cd3eacda7e4cc797bc45f27988ae4b

  • SHA512

    c46175dff9faa852a011e190bb5ee46c2dd1bc4d08b8f65a5dbb83ea9bcd301e357260093c006311c3d78f2870c637432cf39aad37e7817ec1e02d75f805b041

  • SSDEEP

    49152:Gv+lL26AaNeWgPhlmVqvMQ7XSKjztshcarNuoGduV3THHB72eh2NT:GvuL26AaNeWgPhlmVqkQ7XSKv+h+S

Score
10/10
infected testquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Infected test

C2

awoware.ddns.net:4782

Mutex

a46df2cf-6f2e-4cf5-9732-40029ae42fb8

Attributes
  • encryption_key

    692531BB288025573CF8BB036096FEB1D95ACA2B

  • install_name

    WinSS.exe

  • log_directory

    WSSErrorReporting

  • reconnect_delay

    3000

  • startup_key

    SystemNativesSS

  • subdirectory

    WindowsServerServices

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections