General

  • Target
    e0bc13d8be65d524a6e7f23a0764b2ae.bin
  • Size 773KB
  • Sample240730-c26hxaxeqa
  • SHA256 fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.0

Botnet
  • TRAINING

C2
  • 185.241.208.185:16145

Mutex
  • 22073971-8d9a-4364-9916-abbb09ac9d8b

Attributes
  • encryption_key

    7A9A8376440E3257DB2B54403642F366A5FBE14A

  • install_name

    Starter Module.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Starter Module

  • subdirectory

    Modules

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • e0bc13d8be65d524a6e7f23a0764b2ae.bin
    .zip 773KB
  • DLL/kksvv.dll
    .dll 576KB
  • DLL/msvcp140.dll
    .dll 576KB
  • DLL/vcruntime.dll
    .dll 576KB
  • RedEngine.exe
    .exe 502KB
  • Tutorial.txt
    134B

e0bc13d8be65d524a6e7f23a0764b2ae.bin

  • SHA256 fc767ffc7f989455ce6aa641b29c14510d8de441cb423c211421e41d92febc10
  • MD5 SHA1 SHA512 SSDEEP
Password
infected