Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ZenlessZoneZero_install_ua_40658862c6c4.exe

  • Size

    3.4MB

  • MD5

    315faa777f6ed07561811f96aac27748

  • SHA1

    530817820c205130ebb9bcc760cf224b71efa575

  • SHA256

    d06ea9a691205ebdf9994682c6afb6c7c063b74d6cf88e87b3d1059bfffca95a

  • SHA512

    b6288ef4321f1b3ca99ee35ad456daafc4d4b64183d43637117fd5a92c6a35e783fe576c1851778c5abb280fdc80aec5c38dda847ca88c0923f1b837d5000c9a

  • SSDEEP

    98304:KvMt2d5aKCuVPzlEmVQ0wvwfPgKCJ6SLLLLLLLvLLcL2v:8VqwwKCJB

Score
10/10
zzzquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ZZZ

C2

192.168.56.1:4782

Mutex

711cce52-1179-47b5-a1ea-99cd3a6e8cb5

Attributes
  • encryption_key

    0E84F4D4459F2950570FEBA5B703F604DF863FC1

  • install_name

    ZenlessZoneZero_install_ua_40658862c6c4.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ZenlessZoneZero_install_ua_40658862c6c4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections