Overview

overview

10

Static

static

10

celex.exe

windows7-x64

10

celex.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    celex.exe

  • Size

    3.1MB

  • MD5

    e97bf71664c901e2dd3b02c158d14cc7

  • SHA1

    75827ff9fefcd7bab397d6a7af15f3093e38d1c6

  • SHA256

    85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7

  • SHA512

    532b0dcb2027cafb2a568c692360589d855b8c36bcd22b7dfb92c7b71b437e03dc26a55da0c3d0163b3286b9b63980e30d5ebb4d7e5fa6dd2ed3f1aba5f09476

  • SSDEEP

    49152:PvmI22SsaNYfdPBldt698dBcjHpuxNESENk/iJLoGd51THHB72eh2NT:Pvr22SsaNYfdPBldt6+dBcjHMxgZ

Score
10/10
skidquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

skid

C2

xxvvsn-26169.portmap.host:26169

Mutex

8226deb0-3b7d-44c1-a400-b0a3ce09f515

Attributes
  • encryption_key

    4D464C4B380567B78AB5A85F3161F2F36BAFBE7A

  • install_name

    clnt.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    clnt

  • subdirectory

    clnt

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • celex.exe
    .exe windows:4 windows x86 arch:x86

    Password: 123333

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections