General

  • Target

    TIG OL BITTIES.exe

  • Size

    3.1MB

  • MD5

    921a129aac6afeb650d65e9e6ee95693

  • SHA1

    d31f3c41a51fe560b651a7848da5e7d2dad3968d

  • SHA256

    7402ecfc2a0bd1a3facac5354d3a48fe1d097b2e820f561ea786eb3ed36bc054

  • SHA512

    64a411b6c2dbc7977238fd7bc87c29c34e5f0805fbf6ce0664107ccc8175036f1bf54b1deb0759228c3d25014a4e8272fd6509d5a4fcc4f66a5bf02e5da31b4b

  • SSDEEP

    49152:fv0bL21CaSu9ZPRlIMOyGK+K1ZkONB6ABxHRoGd7THHB72eh2NT:fvOL21CaSu9ZPRlIMOjK+K1Zki6W

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

It was the first day Back to school Cuttin up in class Actin like a tool Friends are rollin in We started talkin bout the summer DJ saw Twilight Bummer I spoke up And I asked my friends "Are there any new girls? nines or tens?" Hopin a few hotties Had moved from other cities And in walked this girl With Tig 'Ol Bitties Whoo I can't believe my eyes In a contest they'd win first prize Double D, guarantee I was checkin the size It's like two beach balls in a shirt disguise Or earth and mars Havin some fun Wait I take that back It's like two of the sun But at this point i let my mind run And drifted off thinkin bout them Tig 'Ol Bitties Hah, Tig 'Ol Bitties Mount Fuji brought it's twin Tig 'Ol Bitties Two melons in a shirt Tig 'Ol Bitties Tig 'Ol Bitties I put books in my lap Tig 'Ol Bitties Heads bobbin as she walks Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Kept trippin in class cuz of her dang breasts in a tiny white shirt Boobs havin a fiesta Later in lab We were messin with test tubes Couldn't keep my eyes off the new girls chest Boobs! Wasn't payin attention Got busted Had to serve detention In biology We talked about the bees The best kinda bees Boob-bees Whoo I can't believe my mind I hold a pokerface to her two of a kind With each step Her breasts gettin redefined I'm makin my move I'm thinkin it's time Oh snap I'mma ask her to prom And in my head She responds "you're the bomb" Feelin nervous So I count to three "I like your boobs, go to prom with me?" Hah, Tig 'Ol Bitties King kong boobs Tig 'Ol Bitties Great tracks of land Tig 'Ol Bitties Tig 'Ol Bitties Like my balls Tig 'Ol Bitties Real big Tig 'Ol Bitties Oh my god! Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties Tig 'Ol Bitties She said yes So I'm gettin ready Stain on my shirt Mom's spaghetti I pick her up And I'm pretty sure That she'll let me motor-boat like rrrrrr I try to cop a feel once we get to school She said "No touching, that's the rule" Principal walks up on the scene "It's time to announce prom king and queen Your Favorite Martian and Tig 'Ol Bitties Congratulations to you both on winning" Time slowed down and she jumped for joy When out of her dress jumped something more Tissues flew and rained from the sky Oh my god you stuff your shirt!? Your Favorite Martian in a world of hurt Awwww fake 'Ol Bitties Wow! Fake 'Ol Bitties You breakin my heart with Fake 'Ol Bitties You're crushin my dreams with Fake 'Ol Bitties Fake 'Ol Bitties I can't believable it Fake 'Ol Bitties You really suck Fake 'Ol Bitties I can't believe you would do that Fake 'Ol Bitties Fake 'Ol Bitties Why would you do that when you're just trying to get everyone's attention Stuffed boobs! They're lies! Lies I tell you! But you know I'm still down to make out if you If you want to, want to come back with me You know what, never mind

C2

idk:4782

Mutex

5c7d6a36-dffc-4ec3-8525-ba9161772945

Attributes
  • encryption_key

    7930C3883BFB3E417BEC9036B64E581CD2465EFE

  • install_name

    Byfron.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Balls

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • TIG OL BITTIES.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections