Overview

overview

10

Static

static

10

5ff11acec7...07.exe

windows7-x64

10

5ff11acec7...07.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5ff11acec7be64be449991b8de232e98ad63c54c8c253868b900f95119e52207.exe

  • Size

    3.1MB

  • MD5

    7334140f069dad6624414ba158cc0421

  • SHA1

    07fa089268ff9d0579b3d72722238f55b2d7e134

  • SHA256

    5ff11acec7be64be449991b8de232e98ad63c54c8c253868b900f95119e52207

  • SHA512

    e325d1799e4db5a7a890bdadced86e58da32d2c652dfeafd3999f931b00fa85434934d3e9fc4c9991494a800391bc386bcd84cd7b97cba468925f16456759a98

  • SSDEEP

    49152:mvPlL26AaNeWgPhlmVqvMQ7XSKwiRJ61bR3LoGdKpTHHB72eh2NT:mvdL26AaNeWgPhlmVqkQ7XSKwiRJ6Ha

Score
10/10
fortnite spooferquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

fortnite spoofer

C2

100.80.114.4:4782

Mutex

beb3403b-9dc9-495c-b3c3-cc45b6c99a9f

Attributes
  • encryption_key

    BB72AF51530CE07B54E1C1F697306241CE9CED4C

  • install_name

    fortnite spoofer.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    so good

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5ff11acec7be64be449991b8de232e98ad63c54c8c253868b900f95119e52207.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections