Overview

overview

10

Static

static

10

079513ef52...cs.exe

windows7-x64

10

079513ef52...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    079513ef527fbeccb26b23e5e26f1600_NeikiAnalytics

  • Size

    3.4MB

  • MD5

    079513ef527fbeccb26b23e5e26f1600

  • SHA1

    aa387880a90349cc9ae3f5a53b1f255e51cb9107

  • SHA256

    60bc13d78d5ef441d57434a389501cc93ff8afcd830399f61625d1c33eddccea

  • SHA512

    8939183cfa8e6a3c999d689fd9e9c569bc05700f40336754a8890714a1a8ad1ce6209f4e42c6394930f76b0bcd85559d03b4ef86dfe2ab0efc6fcc5fe9a63c08

  • SSDEEP

    49152:lv+I22SsaNYfdPBldt698dBcjHVkxNESEik/iWLoGdm1THHB72eh2NT:lvz22SsaNYfdPBldt6+dBcjHWxRY

Score
10/10
discordquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Discord

C2

anonam39-28434.portmap.io:28434

Mutex

05aac410-7e7c-4d54-8ab3-5dd8debced86

Attributes
  • encryption_key

    988A53977562DB64E94AB77416B59FECD5DEB50D

  • install_name

    Discord.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    a7

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 079513ef527fbeccb26b23e5e26f1600_NeikiAnalytics
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections