Overview

overview

10

Static

static

10

wm.exe

windows7-x64

10

wm.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    wm.exe

  • Size

    3.1MB

  • MD5

    1d13afca9dcecfbc4ef57cce318dfe6b

  • SHA1

    d426a1924958ef763a810b112c53e35b9734ff4c

  • SHA256

    6e2060f5ac86d80be2d3b4f66a229dd3f1114cd3c0b232e8653335dfcf5a75a3

  • SHA512

    c0a846bb6c2723e4eb91975bae50ad4b9218f1ee30f7dec1f9ee287a425009e226eeb16e09684c5cb3b2415f41494c55a1ea2b041b1f592b0793305cce60a988

  • SSDEEP

    49152:zv7I22SsaNYfdPBldt698dBcjHeYRJ6ObR3LoGdSTHHB72eh2NT:zvE22SsaNYfdPBldt6+dBcjHeYRJ6I

Score
10/10
walmartquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

walmart

C2

play.funpass.services:4782

Mutex

54aaaa02-4a8c-4cb9-9e9e-7eb8df40f4cd

Attributes
  • encryption_key

    CEAEA9FD2F3E18352164BB4D9A6F56EFF5E2D896

  • install_name

    MusNotifyIcon.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    System32

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • wm.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections