Overview

overview

10

Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    client1.exe

  • Size

    3.1MB

  • MD5

    57798d4dd91be926e60b37a61e5f40ff

  • SHA1

    ca811e029fdd9949c5c62739240d8c76900ea6e7

  • SHA256

    3df75e2a2dd40eeabac45f81c840dc934c10ba05df05f233b1c26fde5b4c7421

  • SHA512

    a4dab3ee257479d4c97429a4c23ab4b27fad5186f28c00bf6f456771a0d26898a7b0b10bc252f4743d83395e91cb4866e4d08049d88f50fec8cc17c904a00f12

  • SSDEEP

    49152:/vyI22SsaNYfdPBldt698dBcjHAYH7oGd0BTHHB72eh2NT:/vf22SsaNYfdPBldt6+dBcjHAYbE

Score
10/10
v0.1quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

v0.1

C2

147.185.221.19:9264

Mutex

abff0131-e47c-48a9-acbf-670ddd76b7c2

Attributes
  • encryption_key

    86DD7DA02996F71324EA9A66B712B0F1735056E7

  • install_name

    APF.exe

  • log_directory

    ms_ess

  • reconnect_delay

    3000

  • startup_key

    Microsoft application

  • subdirectory

    ms_essentials

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • client1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections