Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    b8d2c372b71475155c7950891b87a25b

  • SHA1

    9397c2500847153f0d0adf8249a80d5a161ab982

  • SHA256

    2d098c97a1e518389dcb1bc2980ba39050eecf6ce6a27406117b899fbaf9eda4

  • SHA512

    13b1832e96e966f82b7607c56d4878a2d6614fd92cf4b282f956d24a1ce7fa60605864ba59ede8c061d08ed179910f11f756e7d85b5edcc2a8cbae8d9acd0be4

  • SSDEEP

    49152:6vht62XlaSFNWPjljiFa2RoUYIWqxNESEak/iuLoGdHTHHB72eh2NT:6vL62XlaSFNWPjljiFXRoUYIvx5Q

Score
10/10
rb14.us.toquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

rb14.us.to

C2

50.158.201.249:9111

Mutex

a4b50d18-85be-42a9-ab44-11fbc5145c9f

Attributes
  • encryption_key

    CC39AF2C64E413DF0A5069C326C9CF7EB38033A3

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    skibidi

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections