Overview

overview

10

Static

static

10

svchost1.exe

windows7-x64

10

svchost1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost1.exe

  • Size

    409KB

  • MD5

    b80b8c569a390b124cb7aaae003c8a82

  • SHA1

    c38fc46e835ccbb538f4df122e501d07562553c4

  • SHA256

    49686a0b50103315e6a2a8af78084b9b5eb485ad4767f2d63043d8969ff9bb23

  • SHA512

    75148f5e619eea0b6f44b3e6ecc0d4e6a97775fee2456209d90c002f8baacfa9109b2be90da6afdf0282c7704a9542bb01c6566d383d4a0b587508e4f6fdfb47

  • SSDEEP

    12288:epsD64e1M8c4Q7JkMgtqB+chi4gjEhNjh:6sG4kMfJiqBNfPh

Score
10/10
seroxen | v3.1.5 |quasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen | v3.1.5 |

C2

nexosmith1231-54169.portmap.host:4782

Mutex

$Sxr-NbHXQzYHWTCnT97XUN

Attributes
  • encryption_key

    v2wYEk6QCkLkJJ1DyEGm

  • install_name

    $sxr-powershell.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Powershell

  • subdirectory

    $sxr-seroxen2

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • svchost1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections