Overview

overview

10

Static

static

10

265ccc5b2d...cs.exe

windows7-x64

10

265ccc5b2d...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    265ccc5b2dc0c825f7d1a65dd3145340_NeikiAnalytics

  • Size

    3.1MB

  • MD5

    265ccc5b2dc0c825f7d1a65dd3145340

  • SHA1

    7111d7905bbe47c59a7f1759793f2d2ef6b6c5e1

  • SHA256

    d34a1086238301234ba85e975fadc050a14b224317a0dd211070fe5c4467f18c

  • SHA512

    804c89ee1120334d9dc9009c42ee0dd8568b31afc0f1d045ea39a51acf71817e803a3cf2f31482cee4973da4b7ba6f24eda7f5c4f72c1eaaad7fb26ac33ffec2

  • SSDEEP

    49152:XvmI22SsaNYfdPBldt698dBcjH8tXRJ6mbR3LoGdxQTHHB72eh2NT:Xvr22SsaNYfdPBldt6+dBcjHsXRJ6g

Score
10/10
clientsquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Clients

C2

greenindianman-49703.portmap.host:49703

Mutex

a81b3de7-2166-4055-925d-fe9dc1d9d6bf

Attributes
  • encryption_key

    95AA1BBAC73B9C4A85C5C9CA17AB01066062736A

  • install_name

    WinRar.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Task Manager

  • subdirectory

    WinRar

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 265ccc5b2dc0c825f7d1a65dd3145340_NeikiAnalytics
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections