Overview

overview

10

Static

static

10

Roaim.exe

windows7-x64

10

Roaim.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Roaim.exe

  • Size

    3.1MB

  • MD5

    777d1d8707724b3ecce5ba77a7f8dd83

  • SHA1

    0bd7bbb52835ac3406c8e703e25c0b8379764f10

  • SHA256

    b1aebd48c0cf33d5b557617f8e00d90b21494d83bd821cbd781c4b5332431a2d

  • SHA512

    2a5fb74615db2bb65e3d124a34faa470fa479f877ca4cc9f95021a8e54b063de08e474845d68b6451bd237bde5c309c526fd2ccf07313e4782582549483604ac

  • SSDEEP

    49152:3v3I22SsaNYfdPBldt698dBcjHqoRJ6EbR3LoGd9THHB72eh2NT:3v422SsaNYfdPBldt6+dBcjHqoRJ6O

Score
10/10
danoquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Dano

C2

fdfsfsdfsfdfdsfs-63743.portmap.host:63743

Mutex

9809e3fa-67ae-4aac-95f7-4b5584f70b24

Attributes
  • encryption_key

    B50DA56DE47DD72DE867D983A3D936BE25F7940F

  • install_name

    JavaUpdater.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    JavaUpdater

  • subdirectory

    Java

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Roaim.exe
    .exe windows:4 windows x86 arch:x86

    Password: 8866

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections