Overview

overview

10

Static

static

10

Byfron Cryptonite.exe

windows10-2004-x64

10

Byfron Cryptonite.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Byfron Cryptonite.exe

  • Size

    3.1MB

  • MD5

    97b861cf1750a4a78f89d1fd9eb12d84

  • SHA1

    170bf74fd57b5556b89583011937afdbc7d4b953

  • SHA256

    f4d11ef2ba124a873fb3f03ae61c0ab81adfe4af2081704e83258e6390c82590

  • SHA512

    455973500ff1421daee9f9711b0855b2573f13d27743372718831f12c19071663ddb0449823ca6c171d3fc6cd807651da2e3ec5a166cba5ba2b258a530a42b5f

  • SSDEEP

    49152:qvLlL26AaNeWgPhlmVqvMQ7XSKHlQgJ1JvPoGd8THHB72eh2NT:qvxL26AaNeWgPhlmVqkQ7XSKHlQgp

Score
10/10
h72k8dsquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

H72K8DS

C2

espiny-38468.portmap.host:38468

Mutex

bb9f7a2f-89e5-486f-8227-ba2ee26e4d41

Attributes
  • encryption_key

    C7EC88A5CCB59BD73EF3F7D4787818BE89C06664

  • install_name

    Win10.5.exe

  • log_directory

    Windows Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 10.5 Boot

  • subdirectory

    Win10.5

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Byfron Cryptonite.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections