General

  • Target

    MinecraftLauncher.exe

  • Size

    3.1MB

  • MD5

    140e3864d405c443c13b30718b14b96a

  • SHA1

    7d550e55dfe2a1f2c7c83572a014e84a63c1f679

  • SHA256

    04aaecc0a4ec229b3bd361bfa08a97482cc9c8350afe36e38e70ad9026e81126

  • SHA512

    72ecb61f059ad5226ac3c4fd90e67be8ec4e6ae2b455ec246db3f8f48b89995f363e3e6b7223435a97fce52a32714bbc56465dbb523b75852ca14c0b4d68e243

  • SSDEEP

    49152:jvOlL26AaNeWgPhlmVqvMQ7XSKkTmy3zoSdvWWYTHHB72eh2NT:jv+L26AaNeWgPhlmVqkQ7XSKMmyDx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

MinecraftLauncher

C2

5.197.224.63:4782

Mutex

91e0511c-0d95-4c92-93c0-7fa5566a24e6

Attributes
  • encryption_key

    E67C36D8068D267929AA9AB6EBED9453C1E121DF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • MinecraftLauncher.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections