Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    e3c2d0b1836b0a0986bbda8072796ab0

  • SHA1

    3ba54aca2acaa078d11e189e0b9e5cf3f57ddfb9

  • SHA256

    e51be2754c440078f3945070b08d88d18b0973ae44353376b92c9cc6136f17a5

  • SHA512

    17fb83710814884d9a510c6e60708bf5d7981e461af4b0238520941218af92545d4b2719eefb384d745a06262f67ddc376901aecedf85a3802e61183cef27fc0

  • SSDEEP

    49152:aveI22SsaNYfdPBldt698dBcjHTs1QG0+gvJ2yoGdBTHHB72eh2NT:avT22SsaNYfdPBldt6+dBcjHgg+M

Score
10/10
dillyquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

dilly

C2

lvke-45989.portmap.host:45989

Mutex

0cb49dc2-fd0d-4581-ae1e-04154c41f310

Attributes
  • encryption_key

    E5250226804167CB0B1B4B0E9667D0C056694DCA

  • install_name

    defenderx64.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Defender Helper

  • subdirectory

    en

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections