Overview

overview

10

Static

static

10

Ubi.exe

windows10-1703-x64

10

Ubi.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Ubi.exe

  • Size

    3.1MB

  • MD5

    584ef74a7850119e49d95d2691df481c

  • SHA1

    3cda44a8a0f050dfa9021d1fcf28e27a95e333a6

  • SHA256

    767f8d16487d9c75fa023b6dedfb5cd7274117d99557e2167add8a43c59408e4

  • SHA512

    c8c8bebb84ba9b70903d9c5cee65d8ec0173d8b29d78bc457cf9a8e41a3bb11dd2cf54ea6c6ae8c74d0a5af293c8f5a90119b40cef94a788b2b79425732e45be

  • SSDEEP

    49152:DvfhBYjCO4Dt2d5aKCuVPzlEmVQL0wvwka+CU1JnIoGd4TTHHB72eh2NT:DvPt2d5aKCuVPzlEmVQ0wvwf+C7o

Score
10/10
ubisoftquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Ubisoft

C2

mooose-62053.portmap.host:62053

Mutex

e3e3ae88-50f6-4208-91ec-31241cebe4bd

Attributes
  • encryption_key

    D37F232CF541D50ED258A4266FB3670017C5D105

  • install_name

    UbisoftMarketPlaceSetup.exe

  • log_directory

    TrTrade-Logs

  • reconnect_delay

    3000

  • startup_key

    Ubisoft Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Ubi.exe
    .exe windows:4 windows x86 arch:x86

    Password: qwertyuiop;'

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections