Overview

overview

10

Static

static

10

b14b984222...67.exe

windows7-x64

10

b14b984222...67.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6ff6744642254db2e8edae81cb38e8cd7cd6d96b5eaced93f8164b259081e028

  • Size

    180KB

  • MD5

    9bddac818b55e58e3a0078476833d927

  • SHA1

    b6714a237485fdb31c257789173ca3932e72ceef

  • SHA256

    6ff6744642254db2e8edae81cb38e8cd7cd6d96b5eaced93f8164b259081e028

  • SHA512

    ec5789dbeb9297bef2fa62a78934ee997af2e66fd4a34e6d874a43e514281e72ddfe4deb4bd5534bcf5b98cf80e522f9345604de1633b8ab99f2277c7526eb7a

  • SSDEEP

    3072:Ds+kh/1uKoBiFVhxYiURTKaNW+LuetjZsr+mK4JMog3pYz88qlPiOe35Gkdk:q9uTBizhxYjmEir+mK4J+pCJOIk

Score
10/10
win32quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

win32

C2

youtubevideos.duckdns.org:12

Mutex

QSR_MUTEX_jhzpDVzF2AMxWiXSTT

Attributes
  • encryption_key

    3xofPhxwhU6WKmfGRTs0

  • install_name

    win32.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win32

  • subdirectory

    win32

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6ff6744642254db2e8edae81cb38e8cd7cd6d96b5eaced93f8164b259081e028
    .zip

    Password: infected

  • b14b984222f92302952bff13eb2941b5494e4c0250b9fa5d3d4968157e70fe67.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections