Overview

overview

10

Static

static

10

1700555584...ed.exe

windows7-x64

10

1700555584...ed.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe

  • Size

    916KB

  • MD5

    6d48da1b1beffb52e09d892ff7f460c2

  • SHA1

    db0c7b45471c64dc695c98a5c61a1d3b0b1c5f41

  • SHA256

    cc2cfdb23db8b97c610105eaf704dc18e694b3df11f4a13f7187152955415fdc

  • SHA512

    864c83717d0e637dc624fe5b1d30354bb1212226e179eb52143da02b73a664ed805d68600f9370468b93fc1ad4b0c3d1682bdb2ca38d35a47cecd913d34b5228

  • SSDEEP

    24576:tmkdueXjq0OQKc2YSEegpQRDLusJLK1lkioLP:IkdueXjq0OQKc2YSEegpshk1lk

Score
10/10
queda ツquasar

Malware Config

Extracted

Family

quasar

Version

2.8.0.1

Botnet

Queda ツ

C2

45.61.174.20:5552

Mutex

ZltvfUGAo7zsf3naNu

Attributes
  • encryption_key

    EDWqFemxb3ZTD9Ymr9np

  • install_name

    Venom.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1700555584fd3ebc0fea69edad4a43f2ea79c4fbb01cc833100d64f58c1a7ee1ac4ab23ff0415.dat-decoded.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections