Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    348KB

  • MD5

    f13e96cdc731b22a9cc74d9c6ed168e0

  • SHA1

    8e0cf2aa358f8e0055348e28a149cfbb2344710d

  • SHA256

    7ccf4d4fb3d20aa355f8ced13e9f4d1f02568964c7e0d026e8a307e08d79429e

  • SHA512

    7cfe74deca11ed4343f3f952bdad506e23c81539a2599c2980afd56e86d64ac9ea98ac0687c14647f21ef10abe73429ed05826deb62989996a108923b6b5a1b6

  • SSDEEP

    6144:yFIDkAT6QSkszJqxlLXut4bVVbVz0o/bf8upxuunbU5xq+:i6iksIRXujowuplQ5xq+

Score
10/10
penisquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

penis

C2

torbrowser-39837.portmap.host:39837

Mutex

QSR_MUTEX_l5C5izeTNSIAxx35Fg

Attributes
  • encryption_key

    qEyEf0WJT0W987UALat6

  • install_name

    WindowsSound.exe

  • log_directory

    Logs

  • reconnect_delay

    200

  • startup_key

    WindowsSound

  • subdirectory

    SystemSoundClient

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections