Overview

overview

10

Static

static

10

bfc0bbad9b...18.exe

windows7-x64

10

bfc0bbad9b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bfc0bbad9b31a4e51ff7bd4cf86d03ca_JaffaCakes118

  • Size

    348KB

  • MD5

    bfc0bbad9b31a4e51ff7bd4cf86d03ca

  • SHA1

    0ab2b7f9bf6f34b78292a36c5c9457c1254044ee

  • SHA256

    3a0db362ebf14161a5a1e94e3b55426f74ecdefba47968e2f6e8a20a8ca3f858

  • SHA512

    c40957cca5416e3f1fb7cafd931973d0a47d15ca1470f49bd710180a2cea7052c092e555cfeaaa1f9a6cee5afbd205be5b25229ee626efc6601af0feacf2f929

  • SSDEEP

    6144:5On4ccY0Fdkqg/bOc0Juqbbu4jJFBq+upmVLHcVRd:ISY0vg/b68yjPBjYmVL8vd

Score
10/10
botnetquasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

botnet

C2

razilov06.hldns.ru:43844

razilov06.hldns.ru:44844

razilov06.hldns.ru:44444

razilov06.hldns.ru:44344

localhost:43844
Mutex

QSR_MUTEX_jksNafskcOp37von76

Attributes
  • encryption_key

    BZwkHzLAThZvXHJK9c73

  • install_name

    Srvise.exe

  • log_directory

    Log

  • reconnect_delay

    3000

  • startup_key

    Srvise

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bfc0bbad9b31a4e51ff7bd4cf86d03ca_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections