Overview

overview

10

Static

static

10

e5671b2ef3...59.exe

windows7-x64

10

e5671b2ef3...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e5671b2ef3033dc3040c0941406bee1a4bfc83400625c51c306525f5d5070159

  • Size

    3.1MB

  • MD5

    5276106cb50b0c7ba3097883941842f0

  • SHA1

    faec4935c7849ad2ff2985d9c89bd45bd3f35538

  • SHA256

    e5671b2ef3033dc3040c0941406bee1a4bfc83400625c51c306525f5d5070159

  • SHA512

    e040bb419e431f9dd5ce1e1032d817d2fd65fa2689c9c895474c089619b9617f0fdfbf7c7d6ffea5c83c94df4f0f83b2451565dd602165a8844a4580edb5d689

  • SSDEEP

    49152:vvkt62XlaSFNWPjljiFa2RoUYIs8fUIxHoGd8UTHHB72eh2NT:vv462XlaSFNWPjljiFXRoUYIfft

Score
10/10
meisquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

meis

C2

99.103.131.181:5555

Mutex

d8d686b5-9d56-4962-9b60-5efd0cf86275

Attributes
  • encryption_key

    8E26C942521AFFAD0B0582D26F0A1D7AFA50237B

  • install_name

    Driversw.exe

  • log_directory

    rog

  • reconnect_delay

    3000

  • startup_key

    Drivers

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e5671b2ef3033dc3040c0941406bee1a4bfc83400625c51c306525f5d5070159
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections