Overview

overview

10

Static

static

10

real.exe

windows10-1703-x64

10

real.exe

windows10-2004-x64

real.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    real.exe

  • Size

    409KB

  • MD5

    16be7896ffd96f3c15ca40ff3243674f

  • SHA1

    321e82e120535d5f48430284804d5aca5f78d8c7

  • SHA256

    e297f022413aee60290878fd253b68ecb9af7e7919ddae6093a977c10b47ca07

  • SHA512

    6dda93f0e4e47caf40bf15372fd8edee36b8a66d4d6ee3a6e1400c9297cbaa32584c6f8c97e2e76c4e3cd8b195d8e9cbb898870559e7a7177db97eb8c0a521ad

  • SSDEEP

    12288:8Bwz9Fx/nIlyLcnRKIZduz8IWQygCLZG9:8+J0sLYpuz8bQygB

Score
10/10
rslavesquasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

RSlaves

C2

147.185.221.19:33587

Mutex

$Sxr-hphEGEvqSUG7C0u46T

Attributes
  • encryption_key

    6jSzwDnfbfYdZp3ml07G

  • install_name

    WDefenderUpdater.exe

  • log_directory

    UpdLog

  • reconnect_delay

    3000

  • startup_key

    WindowsBIOSupd

  • subdirectory

    Microsoft

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • real.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections