Overview

overview

10

Static

static

10

57ad046ad5...0N.exe

windows7-x64

10

57ad046ad5...0N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    57ad046ad5ca4ffa84f956d8d9b54340N.exe

  • Size

    3.1MB

  • MD5

    57ad046ad5ca4ffa84f956d8d9b54340

  • SHA1

    4b75f2f8c8588faf70de99e822a4f975c1e908ba

  • SHA256

    c85a1fb77763058233f61063686e62b2a9c92acebd3481f58dafdc331724f082

  • SHA512

    76c93dc3ab9c613f77041a7042f936445477f61f9dee35172549a281578c92dcabdb6233371672e4c1b6ef3346f96807e3f8f106a446dea8ed03aded57a5166a

  • SSDEEP

    49152:ivIt62XlaSFNWPjljiFa2RoUYIaxOEMkxk/JxhoGdKDHTHHB72eh2NT:ivE62XlaSFNWPjljiFXRoUYIaxYj6

Score
10/10
rtmquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RTM

C2

51.222.21.20:8080

Mutex

8a15d44f-c8ea-4cee-b65c-6aa4be97ba8e

Attributes
  • encryption_key

    ADA23CE5311AC0879D06D0A900DEA24A44433A30

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Window Service

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 57ad046ad5ca4ffa84f956d8d9b54340N.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections