Overview

overview

10

Static

static

10

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file.exe

  • Size

    3.1MB

  • MD5

    cded3e935b1541f8e930f07e8829f551

  • SHA1

    e7fc4bc9525e5b04b6877ed362ecfcec83fa2d8c

  • SHA256

    7402de539089b009b82d0d643d7b78234c792407d18ab99fd68de78493dede31

  • SHA512

    dd979da2ee725fcdb49a094617fd8e41a283f3dbd809fd939c009ff5609a29e0042be7c6d92cf30c1219b0a9d56ee406a865d1e32ef5b56fdc1f3580bce83d05

  • SSDEEP

    49152:rvSI22SsaNYfdPBldt698dBcjHPCbm9mz6yoGdBTHHB72eh2NT:rv/22SsaNYfdPBldt6+dBcjHabmw

Score
10/10
vcruntime140quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

vcruntime140

C2

192.168.178.57:4782

Mutex

b358e7e9-0f3b-4d47-8e56-2ccc087705cb

Attributes
  • encryption_key

    B1736A0DDBD7AF739BB0E3FE61B51CEFF7F8DDB3

  • install_name

    vcruntime140.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    vcruntime140

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • file.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections