General
-
Target
84dcf85ef6b6da9fb86db16e777e1780_NeikiAnalytics.exe
-
Size
3.1MB
-
MD5
84dcf85ef6b6da9fb86db16e777e1780
-
SHA1
7fb44a0549aefd0a353bf4b19b690b4ec5c6647a
-
SHA256
108ba2d8bbbd602580d507f9abd001b0ce97381008e2f7becefdfc728ef2acf0
-
SHA512
4a121c119531ee6bdfc4ce7ee6fbf64b910f0557d7828399df0f549a5656737b343eb4cad48c7682643b6dddbcb7cde9c055f18bc718223682ae09f49cc1695c
-
SSDEEP
49152:2vQt62XlaSFNWPjljiFa2RoUYIEfX4ECswk/G8GoGd1owOTHHB72eh2NT:2vc62XlaSFNWPjljiFXRoUYIEfXYx6
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Clients
C2
195.20.255.80:1738
Mutex
605f2851-0092-4098-9c57-f2d81f9174e3
Attributes
-
encryption_key
EF6FD7046495B125241282E670A0F8EEF4DE6EF4
-
install_name
solara.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
solara executor
-
subdirectory
solara
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
84dcf85ef6b6da9fb86db16e777e1780_NeikiAnalytics.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections