Overview

overview

10

Static

static

10

R0X-Built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    R0X-Built.exe

  • Size

    409KB

  • MD5

    2812f62b21fe2118e1259169e015b054

  • SHA1

    e96a2077f063b0c5fc9708f9c1e89283999e4211

  • SHA256

    c2fac5230442f151a25ac8b3765caa659ecfe9e32e4e45e6e8097365a9a14436

  • SHA512

    bf5e18186402fcfd5dcd79bbbbe382ff9754e69098b6477dcef8cb3d69d71d67857fe6caf2362ed14aaf79412afb396a0f829a44335b31b7497ce0f690bb2aa2

  • SSDEEP

    6144:cMP9p1kREG60olVji9QzNg/IiSjFqBFK6WbMN6Y44vZqJBWAb7yMTj:XpiREGJ2ji9QyAhK/N6gBqJBj7yMTj

Score
10/10
slavequasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

C2

192.168.1.20:4782

localhost:4782
Mutex

$Sxr-3vDee7FzoJnhqjuE3n

Attributes
  • encryption_key

    hwZQsCIcvotNKosjYueb

  • install_name

    $srr-powershell.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    $srr-mstha

  • subdirectory

    Windows

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • R0X-Built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections