General
-
Target
ad366bd87463311c921172b86a72eb415e80e53017833b0ffa9ddf9da40d6623N
-
Size
3.1MB
-
MD5
689a277c53065be1bc99226d5db58a10
-
SHA1
ca510c6e075b1f169941f21a083870a0c1cb7736
-
SHA256
ad366bd87463311c921172b86a72eb415e80e53017833b0ffa9ddf9da40d6623
-
SHA512
c5e83a9b30808a71aae294c8185bb750d777bff925bca3afdadff811740c776892a54b56d4700e673be7d2dac51633737f6742c4fd35356d658712468520772b
-
SSDEEP
49152:rvmI22SsaNYfdPBldt698dBcjHc1/IE2HWk/uVxoGdRMTHHB72eh2NT:rvr22SsaNYfdPBldt6+dBcjHc1/rj
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Roblox
C2
IylanHammoudi2-38627.portmap.host:38627
Mutex
1eb95760-af5c-4bad-86c9-ba67d57bf2bd
Attributes
-
encryption_key
CB7D244A9DE72B0CB9BB660739C263C800A37650
-
install_name
Roblox.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Roblox
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
ad366bd87463311c921172b86a72eb415e80e53017833b0ffa9ddf9da40d6623N
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections