Overview

overview

10

Static

static

10

Sxr_Installer.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sxr_Installer.bat

  • Size

    409KB

  • MD5

    9eaba1c208b8e7a0c94c109e60c5b113

  • SHA1

    a602439a57a44287dff1d980d2c959c0d934a9e4

  • SHA256

    ab6f4a4fa9bbdf8d9461023a2819b76b07d93e7d31e9d97a490f8ed4c0c0dccc

  • SHA512

    625363f1203596200cd6fdc7c9f9ce8b6af0634299dc750f490305822385d8915981c8c7a162588959dbf000a7d8b4af8d61352fd84a176207c592ded2f87fa6

  • SSDEEP

    6144:cM8epTb9xiovsu3xkkMLK6EuqFHg600SsDMjboALeOu9t8Zyd6/TXQQxZoIv:bp/9xisjxkkMQuWMwgun8Zk67XtxZZv

Score
10/10
seroxenquasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

C2

chinese-golden.gl.at.ply.gg:44086

Mutex

$Sxr-8pC7X2mG070btopC86

Attributes
  • encryption_key

    X7DsXqksH10Qr4Gz4fsk

  • install_name

    HAHAHAHAHA LMAOO.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Svhost

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Sxr_Installer.bat
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections