Overview

overview

10

Static

static

10

525e8e9387...7b.exe

windows7-x64

10

525e8e9387...7b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    525e8e93879800f52388ecded3ed997b

  • Size

    1.0MB

  • MD5

    525e8e93879800f52388ecded3ed997b

  • SHA1

    f0a6f2eabdf5311877753bb1e534224f28f87cba

  • SHA256

    8a859f9e6c51778941082f3e38655f754f5392e36081e5b49a160f00738e1182

  • SHA512

    f29c4db76d513f1bd6b564930039c6e927c383fac0dcc19d827f4033d4a90f74ebc93e9566e78b8b1ea205c3f7f93846f6f0ba31ef5de5e43136968dc61bd7b4

  • SSDEEP

    24576:4AhfC41BrFDRPNL5XVThfbDnn5elpjEn8d:fhfC41BrFDRPNL5XVThfbDn5elpY

Score
10/10
nexiionnquasar

Malware Config

Extracted

Family

quasar

Version

2.7.0.0

Botnet

Nexiionn

C2

lafeuilee.duckdns.org :1604

Mutex

atSRpiCqFfHXqWfe9s

Attributes
  • encryption_key

    VWn5wMxOfB4w4jSVt1as

  • install_name

    Nexxiion.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    windows

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 525e8e93879800f52388ecded3ed997b
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections