General
-
Target
61a74448a0a10c347f93e94665a78030_NEAS
-
Size
3.1MB
-
MD5
61a74448a0a10c347f93e94665a78030
-
SHA1
aac49f37b1ed85908cdbdfc196138fd2fc037fd6
-
SHA256
f708298f6825c13c6c8c898833a5bfa95074e54d094283f48709b03f6a78062e
-
SHA512
b620c7c083d0f40ae3c55e13b1e721fa29d90cb8f2c30661208bed4e38026cf902fa4e09308515fbf2ab12c218266fac1045b8580879201e9e4bdcd8f9ed1eba
-
SSDEEP
49152:seU9Hs+9S++/Ws3jhMglfvs91/hN0iExjAihyvT8ijzin0behJsjyuy96vwx2xAd:sekHxzi0berEyuFvnAD
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
SeroXen
C2
127.0.0.1:65362
common-congratulations.gl.at.ply.gg:65362
Mutex
6dce329d-09b5-4cdb-b1e5-11da2e4ea590
Attributes
-
encryption_key
CBC19B9A3E9EB4E5A14FBE92CED9111175A659E7
-
install_name
$77-$77-$77-$77-$77-powershell.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
$77-$77-$77-$77-$77-powershell.exe
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
61a74448a0a10c347f93e94665a78030_NEAS
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections