Overview

overview

10

Static

static

10

Midnight.exe

windows7-x64

10

Midnight.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Midnight.exe

  • Size

    443KB

  • MD5

    89f6941c3777644ec02f0d062612bc7c

  • SHA1

    1bde66e111a18e4017f87d1c56197a9b066329d0

  • SHA256

    c8064b27b00d4ca2b44dcefcb6d93651b4fe207f5d3081a984aa3809cd04fa53

  • SHA512

    a730526b09c137b9cfeda313074e28249dbe4a8de6e7e930371713a4bac5b215e90a9b1041cb207067b73383fca50f75cfd4a3ab8c077c018b961280e22186ee

  • SSDEEP

    6144:fMH6pULD64e1CxwPzyNYNovX6ln7FHg60f/J7b+zH9w2GF2JMuYJKzAU01:DpsD64e1M6zyNYqyUOZw2Gnu0Kzp01

Score
10/10
seroxen | v3.1.5 |quasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen | v3.1.5 |

C2

most-strengthening.gl.at.ply.gg:14977

Mutex

$Sxr-jy6vh8CtEJL5ceZuIb

Attributes
  • encryption_key

    fHBlHxQIymZ34r4DnzQK

  • install_name

    $sxr-powershell.exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    3000

  • startup_key

    Powershell

  • subdirectory

    $sxr-seroxen2

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Midnight.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections