General
-
Target
surrogate.exe
-
Size
3.1MB
-
MD5
9fa12d20004165ea56457120cc040515
-
SHA1
231e35f6914f2acb10d3fb587214bc0c7e4b2cd4
-
SHA256
8bc7b03305871f613e3e6435ad6ef4d284350e44f77ee67104bb1d0193557497
-
SHA512
d51db655e00ffcc318e18f61f398206582830836c4a140e19de27b53c3004bcd0fc6a705d5a46dca232af9328de90135040a91253dd550f73311683aaffdf5d2
-
SSDEEP
49152:3vAz92YpaQI6oPZlhP3ReybewoQmxNESE0k/iVLoGdQTTHHB72eh2NT:3va92YpaQI6oPZlhP3YybewoRxrtg
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
newborn
C2
cock.holyshithowmanydomainandproxycanigettorunmyserver.info:4782
88.209.197.253:4782
Mutex
5680e0b1-d1d4-41d1-ab33-74f7f95f53fd
Attributes
-
encryption_key
CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896
-
install_name
COM Surrogate.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Update
-
subdirectory
System32
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
surrogate.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections