Overview

overview

10

Static

static

10

561d2b135a...7a.exe

windows7-x64

10

561d2b135a...7a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    561d2b135a6200ef094b222eb47af87a.bin

  • Size

    3.1MB

  • MD5

    561d2b135a6200ef094b222eb47af87a

  • SHA1

    4db2f2254cae3695a0ffa7ccdc13097db254cd8c

  • SHA256

    c458feb66832df6a0c361d951c60bcda34c4f5c82652d25c5e4a1aa4c41d8d94

  • SHA512

    6bd32a9099968b13150a16ee919684e319a67a55dc436fb36157901528e5ccf0283daecdafd07876186f00af13a3bba170a6328926156578a2c06455772b0094

  • SSDEEP

    49152:mvyI22SsaNYfdPBldt698dBcjHHCy1JcLoGdVWTHHB72eh2NT:mvf22SsaNYfdPBldt6+dBcjHHCv

Score
10/10
slavequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

140.238.91.110:36039

Mutex

df49f69a-66a2-4b6e-bb60-18c12b5b14df

Attributes
  • encryption_key

    6A1671418BB270D703D501AB8E9B41E8D413B6D3

  • install_name

    Client.exe

  • log_directory

    Win64ErrorLogs

  • reconnect_delay

    3000

  • startup_key

    Windows Boot Menu

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 561d2b135a6200ef094b222eb47af87a.bin
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections