Overview

overview

10

Static

static

10

0x000f0000...59.exe

windows7-x64

10

0x000f0000...59.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0x000f0000000054ab-159.dat

  • Size

    3.1MB

  • MD5

    1c35fbe0502a246c9e89d91c80ab65f6

  • SHA1

    cb2c72b76cbce0ad3338c7f8b84b52f80d3aa3a5

  • SHA256

    3effc3594b1ec71f6b1cdf420ed0dab7fdbb675b1b9c22dbf13d5de56ba137b6

  • SHA512

    a965a884b6a3a4869f6e466667700f32f11f821a1aa8cd367ebaea43b9aa5227c04514728ac786a88fef031e1d24cae0f244a3efedcb6328f952664bf4079701

  • SSDEEP

    49152:Wv2I22SsaNYfdPBldt698dBcjHX8xNESE4k/iRLoGdoMTHHB72eh2NT:Wvb22SsaNYfdPBldt6+dBcjHMxPh

Score
10/10
terrquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

TERR

C2

77.232.132.25:4999

Mutex

3cc5db7e-8210-40a3-9fe3-434d1f73d4d8

Attributes
  • encryption_key

    790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB

  • install_name

    LestaClient.exe

  • log_directory

    LestaLogs

  • reconnect_delay

    3000

  • startup_key

    Lesta Game Center

  • subdirectory

    Lesta

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0x000f0000000054ab-159.dat
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections