General

  • Target

    SynapseX.revamaped.V1.2.rar

  • Size

    160.0MB

  • MD5

    cd5ec11c593656d4106791c71663b56a

  • SHA1

    bd9987f8d1c6f44a35e37cb9fcc14d0bd8d430e6

  • SHA256

    55dd41e0614ba9b4406c926cc1fd970351d14d11552f3a85d522af46b0a49e46

  • SHA512

    63efb6ed75253c0b016649da1964225ce55c85a7051ff898556b09483ef1e2a6f63f721797b8a92595b4830a1fe34f02236a9f59680014181a6a7c09eaa41d9a

  • SSDEEP

    3145728:SXqMQ+crhy8Vm/7kNm6kUhA9DxSs8FpSHNnIBnPmKuLT8gf/c2W:SXtQ+cD0/7DUh8LIBnPgX8B2W

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Windows Update

C2

skbidiooiilet-31205.portmap.host:31205

Mutex

7357b58d-e5d4-42be-8b74-db6eee6cde6d

Attributes
  • encryption_key

    6F721445F7E0B1CF58980D84A9D49F4458D4EFD9

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsUpdate

  • subdirectory

    Windows Update

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 15 IoCs

    Checks for missing Authenticode signature.

Files

  • SynapseX.revamaped.V1.2.rar
    .rar
  • SynapseX revamaped V1.2/Synapse X Launcher.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/auth/internal/3132e54eb7c.bin
  • SynapseX revamaped V1.2/bin/359k6u5HUNL4tEk.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/bin/CefSharp.BrowserSubprocess.Core.dll
    .dll windows:6 windows x86 arch:x86

    fde2444b18b6216754e4fc4814644d8e


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/CefSharp.BrowserSubprocess.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/bin/CefSharp.Core.dll
    .dll windows:6 windows x86 arch:x86

    af78785d32f8a71e4fa9e723274794fb


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/CefSharp.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/bin/CefSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/bin/Editor.html
    .html .js polyglot
  • SynapseX revamaped V1.2/bin/JTYGLdAQoGLS.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/OoxIi8qtt.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SynapseX revamaped V1.2/bin/SynapseInjector.dll
    .dll windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/bps/EMIL LÄS.txt
  • SynapseX revamaped V1.2/bin/chrome_elf.dll
    .dll windows:5 windows x86 arch:x86

    6c7f78b513ad182e8a21e1896f38ccbc


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    0f31485cd3d6d36b416b744fa9701f28


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/libEGL.dll
    .dll windows:5 windows x86 arch:x86

    ecadf61e50ed499e76a9b050ab8fff13


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/libGLESv2.dll
    .dll windows:5 windows x86 arch:x86

    ed3ad6807e7e18eb58140ee5ec71275a


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/libcef.dll
    .dll windows:5 windows x86 arch:x86

    a497d92372a39dde8de16f8ca8258ded


    Headers

    Imports

    Exports

    Sections

  • SynapseX revamaped V1.2/bin/lua-decomp.exe
    .exe windows:6 windows x64 arch:x64


    Headers

    Exports

    Sections