Overview

overview

10

Static

static

10

0847a32772...37.exe

windows7-x64

10

0847a32772...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe

  • Size

    3.3MB

  • MD5

    71de7ec63dbc36eac4435afcd17ee03d

  • SHA1

    9c468f6dfae8fd63889e403a67aabc3257bd9e09

  • SHA256

    0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237

  • SHA512

    5a7dccfe897b1940c9d2186bfc13508e4f8a55f15e6d8395f177f9e15ad97ad5c328d179a0d3113271e544d88e1bd74bb54d91bc3f8a8bcb6bd5b0ef142df8fd

  • SSDEEP

    49152:LzbEXehF9XONWogPCy3RUn9NgLOb0THHB72eh2NTQAJ6:L8OLJVogPCy3an9OpAJ6

Score
10/10
service host: windows event logquasar

Malware Config

Extracted

Family

quasar

Version

1.4.3

Botnet

Service Host: Windows Event Log

C2

apple-coupled.gl.at.ply.gg:36473

147.185.221.18:36473
Mutex

44b6c65a-d844-4fa9-9d68-a7df5ab8b127

Attributes
  • encryption_key

    8B7FB23965F229B24068B848FCD6536A6961D4FE

  • install_name

    ServiceHostWindowsEventLog.exe

  • log_directory

    runtime

  • reconnect_delay

    5000

  • startup_key

    Service Host

  • subdirectory

    hdll

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0847a32772909b1685150473294dccd837d8ab3bf8d3a42fc75e8402c8fa9237.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections