Overview

overview

10

Static

static

10

Auroraswap....6.zip

windows7-x64

10

Auroraswap....6.zip

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    Auroraswapp3Alpha-0.6.zip

  • Size

    432KB

  • MD5

    8530006170cc02569238ab0a38caa51d

  • SHA1

    b2296ca5b2bf4cc536faf5fbba82d8a699363ed9

  • SHA256

    a95a5dbaa00a98949c0fe010eb429fd64341db6e49bb9149b86d1c506c5e036a

  • SHA512

    2e0438d3796ec89477ea72a43c8d342a5c00198eaabc31dc7c50f10eaa9a35f16f1fe6017ba696b13e6873bc637e38238ee2bd1959409cc27c24a57964addc64

  • SSDEEP

    3072:EAWbZWu9ke4lUKu7qpk0OtiwxUWGJq9bS8PcPqMl/Wr8/UiO4BJfy:EA1u9kfVSmkxiwjmKSlFG8/UiO1

Score
10/10
gimp1quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

gimp1

C2

193.42.33.210:4444

gimpdns.ddns.net:4444
Mutex

QSR_MUTEX_XwuUSTCgYhmnf6vJ1L

Attributes
  • encryption_key

    lRzFKjYQKUKzh6RyUYYQ

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Auroraswapp3Alpha-0.6.zip
    .zip
  • Auroraswapp3Alpha-0.6/AuroraALPHABUILD.0-6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Auroraswapp3Alpha-0.6/PatchNotes0-6.txt
  • Auroraswapp3Alpha-0.6/dat1
  • Auroraswapp3Alpha-0.6/dat2