Overview

overview

10

Static

static

10

4c9aff4146...42.exe

windows7-x64

10

4c9aff4146...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142

  • Size

    3.1MB

  • Sample

    240805-megw5stbpl

  • MD5

    17807d0af1370c52ea1a1e8b6cf5edc8

  • SHA1

    a7e7526f275b05940f4f2c4fe88ac6fd053e31eb

  • SHA256

    4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142

  • SHA512

    8fec9d74a728990b06983d0815fe0b17c349e693442f545134d65f89c6dbd1fddca7e25982315dea42b0190f39e3aa5145793d6b98e4ded5d4a7779d9fcbb22f

  • SSDEEP

    49152:0HobtR1o2PmNXo7WCr5C5OWnXrYXxHTHHB72eh2NT:0HmRvmNXo7WCr5C5O0

Score
10/10
quasargensisloaderspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

GensisLoader

C2

147.185.221.18:42996

147.185.221.18:1770
Mutex

c2e1b18a-ce93-436d-ad8b-21bf89015e19

Attributes
  • encryption_key

    9E968F05BD874BA1BE086FD1774A027473823F49

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142

    • Size

      3.1MB

    • MD5

      17807d0af1370c52ea1a1e8b6cf5edc8

    • SHA1

      a7e7526f275b05940f4f2c4fe88ac6fd053e31eb

    • SHA256

      4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142

    • SHA512

      8fec9d74a728990b06983d0815fe0b17c349e693442f545134d65f89c6dbd1fddca7e25982315dea42b0190f39e3aa5145793d6b98e4ded5d4a7779d9fcbb22f

    • SSDEEP

      49152:0HobtR1o2PmNXo7WCr5C5OWnXrYXxHTHHB72eh2NT:0HmRvmNXo7WCr5C5O0

    Score
    10/10
    quasargensisloaderspywaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks