Overview

overview

10

Static

static

10

WaveWindows.exe

windows7-x64

10

WaveWindows.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WaveWindows.exe

  • Size

    3.1MB

  • MD5

    a95757da3319d6c993cbe1afe723a2dd

  • SHA1

    2c5d531c008088359135f71d17ccc1438036a1a9

  • SHA256

    cc0f5f9d52d3ac24ccd19022dc321b06829989282d2203ab863318a9af4dc9d4

  • SHA512

    3af286fffbc38907b3c3abfc68bdcea45c1dc2592c0f773746dccec6e70e0bf280397b571f169e2bab23adc3a5d8387aefb6663a119c1346b1883690dc136218

  • SSDEEP

    49152:fv7I22SsaNYfdPBldt698dBcjHH2RJ6QbR3LoGdhwTHHB72eh2NT:fvE22SsaNYfdPBldt6+dBcjHH2RJ6q

Score
10/10
wompwompquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

wompwomp

C2

dani1023-39611.portmap.io:39611

Mutex

0d89942c-a954-4a2f-acbe-8fe1bc1a8045

Attributes
  • encryption_key

    EF35ED3B18159C718A45B88BBAFEB8BBE615824D

  • install_name

    VSREDIST.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Steam

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • WaveWindows.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections