Overview

overview

10

Static

static

10

BoostBot.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BoostBot.exe

  • Size

    409KB

  • MD5

    404ab800bbe49c36bd64d0d73600b59a

  • SHA1

    4c8dff2702fada108f7477ad357067310b584366

  • SHA256

    5465f02f24ee5c1fc9c9c27c86c209eeddc2ed607143e1b76ca9c9d9b7b84154

  • SHA512

    d0ecd88adfd84d9d8e845281e0437368aadf3d1d6fb704d7c7630d1360697471c2a49584f968eeebd5b435f11af9ce3d06327f1835fa5d07a140f22c0f95fc11

  • SSDEEP

    12288:dpyJcC+xB0XbJQtlQDFuYAbtP6j8fXx7EBI:zwd+QJQbQYbl6Ivn

Score
10/10
rpadquasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

RPad

C2

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-okPqrmZ8kNVUcS4Rp0

Attributes
  • encryption_key

    XmcBnPuLlN1e8SHIRR1z

  • install_name

    $sxr-powershell.exe

  • log_directory

    $SXR-LOGS

  • reconnect_delay

    3000

  • startup_key

    $sxr-powershell

  • subdirectory

    $sxr-seroxen2

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • BoostBot.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections