General
-
Target
0x000a000000013a21-7.dat
-
Size
3.1MB
-
MD5
f91699f2ff3f446461a302ea2d69be44
-
SHA1
caf1e89a10b97668773e6150dd4b3cecee194c86
-
SHA256
bccae30d15564418d4f8ee309c47adaa054039a1a68ea59ee95b6a5ef92d8487
-
SHA512
2eb25181445c88044960ad65417cee3c14d83be935c6fc471288687b02c3113851b7b4c980b73994d90688f6e551eeb76001e8cfc120922dacbd5d8c7e3cbc4d
-
SSDEEP
49152:/vOlL26AaNeWgPhlmVqvMQ7XSK0FIkEiU3k/KLoGddq3THHB72eh2NT:/v+L26AaNeWgPhlmVqkQ7XSKuI3
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Webhook
C2
bardu3662.duckdns.org:9733
Mutex
afa58199-2aae-4e08-8ef4-8e4ef39bc0aa
Attributes
-
encryption_key
080342EF5ED2B5D16317695CC4327BF2FFC034AA
-
install_name
RuntimeBroker.exe
-
log_directory
Logs
-
reconnect_delay
1000
-
startup_key
Update
-
subdirectory
ApplicationFrameHost
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0x000a000000013a21-7.dat
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections