Overview

overview

10

Static

static

10

2556-46-0x...ry.exe

windows7-x64

2556-46-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2556-46-0x00000000002F0000-0x000000000034E000-memory.dmp

  • Size

    376KB

  • Sample

    241101-wpsk3atdlh

  • MD5

    831ab5115ce4be7fd221e598d26f1509

  • SHA1

    a958352da59527ef99d17db92149541879b381e1

  • SHA256

    16730e6a1998443461efbf59c3b5f9ef53fe5e38e7f918dc5a63c5be0b19315b

  • SHA512

    8a29d71fb2f078c784ae80e6705d7f8a8104354e61fd7842c06b7022e57844fa5f4a57d325a3c9a74ea9bfd2c0e887c5f434fad6a2bfe977ca3807d97098aebb

  • SSDEEP

    6144:1K2J10qdSlEc39HGx5yVmnKKJfotFCuHi/b25s/Wz0u:1KF6y0KKlotF3iKO/Wz0u

Score
10/10
quasarebayprofiles

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

EbayProfiles

C2

5.8.88.191:443

sockartek.icu:443
Mutex

QSR_MUTEX_0kBRNrRz5TDLEQouI0

Attributes
  • encryption_key

    MWhG6wsClMX8aJM2CVXT

  • install_name

    winsock.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    win defender run

  • subdirectory

    SubDir

Targets

    • Target

      2556-46-0x00000000002F0000-0x000000000034E000-memory.dmp

    • Size

      376KB

    • MD5

      831ab5115ce4be7fd221e598d26f1509

    • SHA1

      a958352da59527ef99d17db92149541879b381e1

    • SHA256

      16730e6a1998443461efbf59c3b5f9ef53fe5e38e7f918dc5a63c5be0b19315b

    • SHA512

      8a29d71fb2f078c784ae80e6705d7f8a8104354e61fd7842c06b7022e57844fa5f4a57d325a3c9a74ea9bfd2c0e887c5f434fad6a2bfe977ca3807d97098aebb

    • SSDEEP

      6144:1K2J10qdSlEc39HGx5yVmnKKJfotFCuHi/b25s/Wz0u:1KF6y0KKlotF3iKO/Wz0u

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks