Overview

overview

10

Static

static

10

5b41d22025...44.exe

windows7-x64

10

5b41d22025...44.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b41d220257bb8b37564d184f6642844.exe

  • Size

    3.1MB

  • MD5

    5b41d220257bb8b37564d184f6642844

  • SHA1

    a39a62c828b80c8211324e5830e151c63e5272d3

  • SHA256

    beb1b5cd2a33e86e48599b183b882fc3e80198a8062e5b9d9251e605d3f0bfd5

  • SHA512

    b5971b3439983db5bcaf7db896b68773553bff41e1a20bebc3e1fa6bf7f6c37e263a706ef0b48c95a68da18b85f4b4cdf59d866cc0fe3de581497653ddff4243

  • SSDEEP

    49152:avjI22SsaNYfdPBldt698dBcjHWvsk9hEvJCLoGdnWzTHHB72eh2NT:avc22SsaNYfdPBldt6+dBcjHahNXW

Score
10/10
fabquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Fab

C2

91.92.241.122:6969

Mutex

fcf2be0a-a426-40c6-b153-1a354814f80d

Attributes
  • encryption_key

    26A6C07FE7354BCD244B108D2E3538DCF04477F5

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 5b41d220257bb8b37564d184f6642844.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections