Overview

overview

10

Static

static

10

SphynxLoader.exe

windows7-x64

10

SphynxLoader.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    SphynxLoader.exe

  • Size

    3.1MB

  • MD5

    4f26f9d29a6a8605da7265d0f4cb61f1

  • SHA1

    8bdbf48da4cea6edd298bb73b34731b503167afd

  • SHA256

    41210f1b03c8344b58cfb724a7ead4e5b7568dfaab39c0d76650058b0c5bf097

  • SHA512

    c9ce0a7e37c18bec6d7e8b7ff75d460661d73967f2a4332bd7574acd6fc2e78eae9dd37f71dda4cd6afa002c319d0b80ab3c7af7bb3fff9fe4d4cd3e0c02883b

  • SSDEEP

    49152:PvkI22SsaNYfdPBldt698dBcjH3gF3mMjAfvMoGd1rNTHHB72eh2NT:PvJ22SsaNYfdPBldt6+dBcjH323L

Score
10/10
discordslavequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

DiscordSlave

C2

outsxz2244.ddns.net:4782

Mutex

031106f8-70c1-4af8-b686-ab93117255b9

Attributes
  • encryption_key

    97D3282EDC7DC8AA18F2A370AF50398268F540BA

  • install_name

    Taskmgr.exe

  • log_directory

    Hmm

  • reconnect_delay

    3000

  • startup_key

    MicroSoftWeb2View

  • subdirectory

    System32

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SphynxLoader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections