General

  • Target

    SynapseX.revamaped.rar

  • Size

    160.0MB

  • MD5

    3812a5893a2abdea718831baa062b718

  • SHA1

    d92570b364fbb1632630f97d459833f76ec65807

  • SHA256

    272aa33a3e9ff89993ba531faad69af778271e13cab169c863545fdef2a6e4f7

  • SHA512

    9d2a64c840fb4f9e6053b5692fb792c5a9c822f1d46ca6a6317b4a77c6ae7539d3bd3c55593b06aba6ccf319697984f2467cdba2f8d2ec7851f9a59dea4b6f80

  • SSDEEP

    3145728:mpzMB+crhy8Vm/7kNm6kUhA9DxSs8FpSHNnBBnPmKuLTtvfOw2T:mpQB+cD0/7DUh8LBBnPgXtZ2T

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

C2

espinyskibidi-29823.portmap.host:29823

Mutex

a94ba996-69af-4720-85e6-f4929c5eb0f8

Attributes
  • encryption_key

    6F721445F7E0B1CF58980D84A9D49F4458D4EFD9

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Update Startup

  • subdirectory

    Windows Update

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

Files

  • SynapseX.revamaped.rar
    .rar
  • SynapseX revamaped/Synapse X Launcher.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped/auth/internal/3132e54eb7c.bin
  • SynapseX revamaped/bin/359k6u5HUNL4tEk.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped/bin/CefSharp.BrowserSubprocess.Core.dll
    .dll windows:6 windows x86 arch:x86

    fde2444b18b6216754e4fc4814644d8e


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/CefSharp.BrowserSubprocess.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped/bin/CefSharp.Core.dll
    .dll windows:6 windows x86 arch:x86

    af78785d32f8a71e4fa9e723274794fb


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/CefSharp.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SynapseX revamaped/bin/CefSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SynapseX revamaped/bin/Editor.html
    .html .js polyglot
  • SynapseX revamaped/bin/JTYGLdAQoGLS.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • SynapseX revamaped/bin/OoxIi8qtt.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped/bin/SynapseInjector.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • SynapseX revamaped/bin/bps/EMIL LÄS.txt
  • SynapseX revamaped/bin/chrome_elf.dll
    .dll windows:5 windows x86 arch:x86

    6c7f78b513ad182e8a21e1896f38ccbc


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    0f31485cd3d6d36b416b744fa9701f28


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/libEGL.dll
    .dll windows:5 windows x86 arch:x86

    ecadf61e50ed499e76a9b050ab8fff13


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    ed3ad6807e7e18eb58140ee5ec71275a


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/libcef.dll
    .dll windows:5 windows x86 arch:x86

    a497d92372a39dde8de16f8ca8258ded


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped/bin/lua-decomp.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections