General

  • Target

    RedEngine.zip

  • Size

    773KB

  • MD5

    e0bc13d8be65d524a6e7f23a0764b2ae

  • SHA1

    451127b271d4b6e40010b90eb74dd8b9bf531d39

  • SHA256

    fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10

  • SHA512

    a70ab7673c006d4ab1fd88b1a44460604fcca765340eb919c77b3ccaec39f85f562a6490ec9b46cd3957335b9a421f68ed710ed9ed3d2e14776f8410c1edb66a

  • SSDEEP

    12288:aHPXfpduG1tAIKZHPXfpduG1tGEsHPXfpduG1tGEqJPb3D58uPHjSW:2PXfpZAIEPXfpZGJPXfpZGvAuPjSW

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

TRAINING

C2

185.241.208.185:16145

Mutex

22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes
  • encryption_key

    7A9A8376440E3257DB2B54403642F366A5FBE14A

  • install_name

    Starter Module.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Starter Module

  • subdirectory

    Modules

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • RedEngine.zip
    .zip
  • DLL/kksvv.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DLL/msvcp140.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • DLL/vcruntime.dll
    .dll windows:6 windows x64 arch:x64

    01c801a34c4715440ef1f25ad689b315


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • RedEngine.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Tutorial.txt