Overview

overview

10

Static

static

10

1736-5-0x0...ry.exe

windows7-x64

1736-5-0x0...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1736-5-0x0000000001650000-0x0000000001974000-memory.dmp

  • Size

    3.1MB

  • MD5

    12084b46988415dc1157331a33220835

  • SHA1

    44f1adc1c1c0368cda7ce065e34cd59dbc294640

  • SHA256

    eeafda6351be2b2b000a650765bace1db2fba6bfe828d5d1117f31f498724123

  • SHA512

    e81acc8a19d48e3a47c2ea6f9bdefda20da43bf7c23f61f499e0d5c3e4ec98397bd40a6ce1a12df65b512c43680b5131a2cd4983d27fe12668455e9452eff9fd

  • SSDEEP

    49152:jvHG42pda6D+/PjlLOlg6yQipVcKxNESEZk/i6LoGd+THHB72eh2NT:jvm42pda6D+/PjlLOlZyQipVtxYk

Score
10/10
gtxdvquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

gtxdv

C2

77.105.132.124:4899

77.105.132.124:2525

77.105.132.70:2525

77.105.132.70:4899
Mutex

4f6b11a0-3dfc-4b48-b2dc-1f9ff07a13ad

Attributes
  • encryption_key

    DD79AF836BD99BD2FC3D66A0613F83FC8A50A5CA

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    DVG8873

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1736-5-0x0000000001650000-0x0000000001974000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections