Overview

overview

10

Static

static

10

87d05f252e...49.exe

windows7-x64

10

87d05f252e...49.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    87d05f252e2417d280bb8c7110f9913e54e5f89fb209181f47eaaad6553ce549

  • Size

    3.1MB

  • MD5

    4bee5738d5053f4ed951f72ece445d1a

  • SHA1

    ed6ff5aa0d945449d4571c5cab6e5e7c95c32b4b

  • SHA256

    87d05f252e2417d280bb8c7110f9913e54e5f89fb209181f47eaaad6553ce549

  • SHA512

    e55a837099572a9fecf096102bd6a6418c3786065e5b2be756d0f5f1ce817a84269f95a82c82ca2275a30659e13db83cbd62f1e7bb8a5b7f6cc4029153178ef9

  • SSDEEP

    49152:avXI22SsaNYfdPBldt698dBcjHhFKKN3Mf90oGdyTHHB72eh2NT:avY22SsaNYfdPBldt6+dBcjHhQKNr

Score
10/10
davquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

dav

C2

192.168.8.142:4782

Mutex

c8684c44-d5dc-43e5-b033-c2a97a0f52a7

Attributes
  • encryption_key

    CBF8A101AC7D1A60E9971CAA6CDD2DFAE2D84DF4

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    StefCodes Antivirus

  • subdirectory

    SubDir

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 87d05f252e2417d280bb8c7110f9913e54e5f89fb209181f47eaaad6553ce549
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections