General
-
Target
ZebraObfuscator.exe
-
Size
3.1MB
-
MD5
a98be80edea7fa660fc36b2702ad262b
-
SHA1
b18b3cada82a61bfbb1ed5d56550223ce0d10fe2
-
SHA256
2acce0fae72f9e23576cc9826106695c4d168cb010927ec45fd404af32db9d0a
-
SHA512
82d7090d044f4bfc2f0993b4fec70b11d0a16364d8c1a764418d95845ae7f67647a800040ea2e8405d0b836eab62f2fe171a420ebafd548d52decec4cae42c4a
-
SSDEEP
49152:TvEI22SsaNYfdPBldt698dBcjHi0iUuBeYuocdkhRoTHHB72eh2NT:Tvp22SsaNYfdPBldt6+dBcjHi5UzG
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Obfuscator
C2
even-lemon.gl.at.ply.gg:33587
Mutex
1272508c-0529-4a9c-ae6e-b9fe2c597a25
Attributes
-
encryption_key
2695178836BA12133DD75A122E23A754EAD78C5F
-
install_name
$sxr-powershell.exe
-
log_directory
Windows
-
reconnect_delay
3000
-
startup_key
Powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ZebraObfuscator.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections