Overview

overview

10

Static

static

10

SphynxLoader.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    SphynxLoader.exe

  • Size

    3.1MB

  • MD5

    f1917082380d566525fad99a06150aad

  • SHA1

    591367ba00b395fcd154f598e466fb9f231510e0

  • SHA256

    42cacef2ca1ab4d7916a5487b456165ce6f0fd644183b8920325daefe246cc29

  • SHA512

    844c87c76063d1cb5e9306202b18ad14064f9c43ab65df80f7baea8d58b75fa995b82e22d371fb2540240396f154b5a7af624aa65fd489c6a505ed1e44ea806e

  • SSDEEP

    49152:CvQt62XlaSFNWPjljiFa2RoUYIiTRy6lbR3LoGdArTHHB72eh2NT:Cvc62XlaSFNWPjljiFXRoUYIiTRy63

Score
10/10
gorillaquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Gorilla

C2

45.11.95.165:5021

Mutex

d36114c2-bfe0-4511-ace9-ffbe3c2ba0cd

Attributes
  • encryption_key

    F0CD9E7CA3137C7B7936A3260B714DFFF3E52DDD

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SphynxLoader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections