General
-
Target
4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142
-
Size
3.1MB
-
MD5
17807d0af1370c52ea1a1e8b6cf5edc8
-
SHA1
a7e7526f275b05940f4f2c4fe88ac6fd053e31eb
-
SHA256
4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142
-
SHA512
8fec9d74a728990b06983d0815fe0b17c349e693442f545134d65f89c6dbd1fddca7e25982315dea42b0190f39e3aa5145793d6b98e4ded5d4a7779d9fcbb22f
-
SSDEEP
49152:0HobtR1o2PmNXo7WCr5C5OWnXrYXxHTHHB72eh2NT:0HmRvmNXo7WCr5C5O0
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
GensisLoader
C2
147.185.221.18:42996
147.185.221.18:1770
Mutex
c2e1b18a-ce93-436d-ad8b-21bf89015e19
Attributes
-
encryption_key
9E968F05BD874BA1BE086FD1774A027473823F49
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4c9aff4146e3fb6e795d2f7cbddea6a8912e14e3c1c5ad384582b80b1c510142
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections