Overview

overview

10

Static

static

10

AuroraALPH...2).exe

windows10-1703-x64

10

AuroraALPH...2).exe

windows7-x64

10

AuroraALPH...2).exe

windows10-2004-x64

10

AuroraALPH...2).exe

windows11-21h2-x64

10

AuroraALPH...3).exe

windows10-1703-x64

10

AuroraALPH...3).exe

windows7-x64

10

AuroraALPH...3).exe

windows10-2004-x64

10

AuroraALPH...3).exe

windows11-21h2-x64

10

AuroraALPH...4).exe

windows10-1703-x64

10

AuroraALPH...4).exe

windows7-x64

10

AuroraALPH...4).exe

windows10-2004-x64

10

AuroraALPH...4).exe

windows11-21h2-x64

10

AuroraALPH...5).exe

windows10-1703-x64

10

AuroraALPH...5).exe

windows7-x64

10

AuroraALPH...5).exe

windows10-2004-x64

10

AuroraALPH...5).exe

windows11-21h2-x64

10

AuroraALPH...py.exe

windows10-1703-x64

10

AuroraALPH...py.exe

windows7-x64

10

AuroraALPH...py.exe

windows10-2004-x64

10

AuroraALPH...py.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    343434.zip

  • Size

    2.5MB

  • MD5

    c72bc91852793ad0fa7be4cd508ac3fc

  • SHA1

    3b4e7a006419e35bacf1917fafc608ae581b0092

  • SHA256

    e2e708e09031d7fa512f31ca4d6b10d0e48df7aff2a5b889477e792c6847a90c

  • SHA512

    3bb4e450c342ab9cc0736a59b1391a529bcce77da5a59297ae943aba5a9393157a711cb5701b4fcfdd68d077211b32e8cac6f9627e4d46fcae033c1f24319110

  • SSDEEP

    24576:JLgsYbcLgsYbNLgsYb6LgsYbcLgsYbRLgsYbF:JLTL+LRLnLALS

Score
10/10
gimp1quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

gimp1

C2

193.42.33.210:4444

gimpdns.ddns.net:4444
Mutex

QSR_MUTEX_XwuUSTCgYhmnf6vJ1L

Attributes
  • encryption_key

    lRzFKjYQKUKzh6RyUYYQ

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 5 IoCs
  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

Files

  • 343434.zip
    .zip
  • AuroraALPHABUILD.0-6 - Copy (2).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AuroraALPHABUILD.0-6 - Copy (3).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AuroraALPHABUILD.0-6 - Copy (4).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AuroraALPHABUILD.0-6 - Copy (5).exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AuroraALPHABUILD.0-6 - Copy.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections