General

  • Target
    uni.zip
  • Size 30.6MB
  • Sample240602-haxdtaed73
  • SHA256 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • quasar

Version
  • 3.1.5

Botnet
  • SeroXen

C2
  • panel-slave.gl.at.ply.gg:57059

  • panel-slave.gl.at.ply.gg:27892

Mutex
  • $Sxr-rpL8EItHN3pqIQQVy2

Attributes
  • encryption_key

    Lme7VBS3l58VwLM69PNM

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    SeroXen

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 64 IoCs
  • Unsigned PE 144 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • uni.zip
    .zip 30.6MB
  • uni/Uni - Copy (10) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (10) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (10) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (11) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (11) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (11) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (12) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (12) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (12) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (13) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (13) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (13) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (14) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (14) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (14) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (15) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (15) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (15) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (16) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (16) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (16) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (17) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (17) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (17) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (18) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (18) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (18) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (19) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (19) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (19) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (2) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (2) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (2) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (2).exe
    .exe 409KB
  • uni/Uni - Copy (20) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (20) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (20) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (21) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (21) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (21) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (22) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (22) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (22) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (23) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (23) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (23) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (24) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (24) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (24) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (25) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (25) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (25) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (26) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (26) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (26) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (27) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (27) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (28) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (28) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (29) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (29) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (3) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (3) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (3) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (3).exe
    .exe 409KB
  • uni/Uni - Copy (30) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (30) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (31) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (31) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (32) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (32) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (33) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (33) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (34) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (34) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (35) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (35) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (36) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (36) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (37) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (38) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (39) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (4) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (4) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (4) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (4).exe
    .exe 409KB
  • uni/Uni - Copy (40) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (41) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (42) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (43) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (44) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (45) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (46) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (47) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (48) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (49) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (5) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (5) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (5) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (5).exe
    .exe 409KB
  • uni/Uni - Copy (50) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (51) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (52) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (53) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (54) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (55) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (56) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (6) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (6) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (6) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (6).exe
    .exe 409KB
  • uni/Uni - Copy (7) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (7) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (7) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (8) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (8) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (8) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (9) - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (9) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy (9) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (10) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (2) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (2) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (2).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (3) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (3) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (3).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (4) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (4) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (4).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (5) - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (5) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (5).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (6) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (6).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (7) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (7).exe
    .exe 409KB
  • uni/Uni - Copy - Copy (8) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy (9) - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy - Copy (2).exe
    .exe 409KB
  • uni/Uni - Copy - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy - Copy.exe
    .exe 409KB
  • uni/Uni - Copy.exe
    .exe 409KB

uni.zip

  • SHA256 956866f40e28cef19324cb165382d5cd5aee0b67c0cb9dd4a39f5bddc6ac56c4
  • MD5 SHA1 SHA512 SSDEEP