Overview

overview

10

Static

static

10

057af395fc...cf.exe

windows7-x64

10

057af395fc...cf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    057af395fc58d45f7cadc9b76fc5a994847d3df7ab3e29ee0bdc9061a31b0dcf

  • Size

    477KB

  • MD5

    a13e513dbc73712c0bdc09c32fbdc88c

  • SHA1

    a8de82020743b0d2516b276ac8c98b280e0d0aa1

  • SHA256

    057af395fc58d45f7cadc9b76fc5a994847d3df7ab3e29ee0bdc9061a31b0dcf

  • SHA512

    1726c5de00dbaf561c0472a8bf8c09f870fb1489592da5a26bd05aa1f0cd8e28cf64d636be713f7641a2fc8a03447b33925889d9c4193b715bcfb37743a9a8a5

  • SSDEEP

    6144:gteiCC1YntN1F9sp8EGZBEL3kjaCjrGXrOHmPc0gJXyNbfxkj07QRGJ7ikb:gte3N1k2E4JGXruJ0gJXyTKkQRGlikb

Score
10/10
defaultquasar

Malware Config

Extracted

Family

quasar

Version

1.0.0

Botnet

Default

C2

134.122.134.39:3955

Mutex

27007a99-bed3-4cf8-ad06-b04d7dcd7cd7

Attributes
  • encryption_key

    77874C87B19D6F969E351806DFEE254A4CDB1F4C

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    EchoRAT Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 057af395fc58d45f7cadc9b76fc5a994847d3df7ab3e29ee0bdc9061a31b0dcf
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections