General
-
Target
2396-4-0x0000000000400000-0x000000000045E000-memory.dmp
-
Size
376KB
-
MD5
c445a51be6ee016b2486e56e3a2f3943
-
SHA1
71017b042e5416d9d271d296f4cd9af7df556638
-
SHA256
20e4b66da211ccc79ba5018bb4a7a7834da7ff3c29036ecb10a601cca0e37e33
-
SHA512
3c2ca1f6186df2dc22d198aa2e7f83bbe5d5d5e9a0dc29be2efe3bb8cbe88a4d095fda77843e0b568de8949e66527363c212a295273ac7ea995cfe5d6f26095b
-
SSDEEP
6144:s8NHXf500M3vcX2iFDBab5Lfi1WUTi6bQT8dp2:pd509cXRkgW+hb28dp2
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.3.0.0
Botnet
VTROY
C2
31.13.224.12:61512
31.13.224.13:61513
Mutex
QSR_MUTEX_4Q2rJqiVyC7hohzbjx
Attributes
-
encryption_key
7Vp2dMCHrMjJthQ2Elyy
-
install_name
downloads.exe
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
cssrse.exe
-
subdirectory
downloadupdates
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2396-4-0x0000000000400000-0x000000000045E000-memory.dmp
Headers
Sections