Overview

overview

10

Static

static

10

Loli.exe

windows7-x64

10

Loli.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Loli.exe

  • Size

    3.1MB

  • MD5

    e4defe976f66c4592d70d7761ad23916

  • SHA1

    f36c613610d150a6b5e4f8808a3ee093305ead95

  • SHA256

    7559f4f322112ed89df27237d1c9b08633c6731a9a4906be77373e673cad2c86

  • SHA512

    acc17808d1b9ecdb8e544cd498fa6a4ed7e3b950950726c1b17ccbda70ec16fbc62bbdae9f9e8bb9890b3bbfb1f9196b9d2628097ab5e1b705d0b7d9d5a2107e

  • SSDEEP

    49152:gvgI22SsaNYfdPBldt698dBcjH1Zyg+vEnTHHB72eh2NT:gvd22SsaNYfdPBldt6+dBcjH1ZR

Score
10/10
slavequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Slave

C2

manufacturer-iran.gl.at.ply.gg:46957

Mutex

261b229e-a9e0-46eb-b59b-76313ea213fe

Attributes
  • encryption_key

    F7ACA224CAA318E1652BB3825C87CAD85F986692

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Loli.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections