General
-
Target
vxzxvzxvzxvzxvt.exe
-
Size
3.1MB
-
MD5
1f7e9c9d3d8e94f38711138069b8f8db
-
SHA1
e6c2dafbcb9ebf03efa5823b2ad0cf3b7edada91
-
SHA256
f93b825086277dab8c069e85b52810a482201869d05737a7f6b885b63818be4d
-
SHA512
4b5f84ecf92b24a412aecd356ff2ccc06df665d6c4c8859b569f09409ce4c2e08ec37f32871f22bbd53216d8f3a93e349239e36c94e86921940d1150a81822ad
-
SSDEEP
49152:4v8G42pda6D+/PjlLOlg6yQipVsxR16pbR3toGdfTHHB72eh2NT:4vH42pda6D+/PjlLOlZyQipVsxR16N
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Shiba
C2
score-seminars.gl.at.ply.gg:35300:35300
asked-schema.gl.at.ply.gg:50093:35300
Mutex
987c652c-2a4e-4c5d-bc39-00c8c0f35c5c
Attributes
-
encryption_key
A88D7FED7F655EBDC4F99C21BAE5EC62300AADC7
-
install_name
$sxr-insta.exe
-
log_directory
$sxr-logs
-
reconnect_delay
1000
-
startup_key
$sxr-mstha
-
subdirectory
$sxr-start
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
vxzxvzxvzxvzxvt.exe
Password: hgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzvhgeaeahavcxzv
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections