Overview

overview

10

Static

static

10

FortniteSk...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    FortniteSkinSwapper.exe

  • Size

    3.1MB

  • MD5

    51d85c79694b92478c49c44ffb0a2a1f

  • SHA1

    ebddf4ea7c16ddf87e6f3430d90b7e0cfbf65feb

  • SHA256

    1cd31e62c0d548a4a3dca57dc9acc30971849b5a0a8e4a6051d33e53705332b0

  • SHA512

    558ad4b0d5551e9cc80f8e94e816401401bd8b2f1f87d91e04438f46eecab38a3933de30d630d5cfb3b801838269a11267c4db59ca3f3e2c693fce0008ca69aa

  • SSDEEP

    49152:Gvwt62XlaSFNWPjljiFa2RoUYInMDCkCWZLoGMEhTHHB72eh2NT:Gv862XlaSFNWPjljiFXRoUYInMDbpx

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.56.1:4782

Mutex

7fb63d61-ef9a-4f48-ba8f-89f4e74f2da4

Attributes
  • encryption_key

    F99EA17205244689BE6F8771CBFF1B56D6AFDFF8

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    system

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • FortniteSkinSwapper.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections