Overview

overview

10

Static

static

10

i - Copy (3).exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UPDATE!.rar

  • Size

    1.0MB

  • MD5

    94043ed2f62579318a9c518977b56d2a

  • SHA1

    5c9372aad250206c81b970fef5671b11d06deaed

  • SHA256

    6e8ea3c47a8e46719c4242a3fb2f5bfa83d9e561f60d56309e98031b94392305

  • SHA512

    fe1e7804da153c5818acb8a0534e9a13492a28b0d2469c9e864546f62004fe4910c5a44c96a3aa2568ffac8c1bdb260ebdf37ab4a5730a06bc7578a3f9519cff

  • SSDEEP

    24576:DwqtbiQ1vFXidJ96G2rnoM8U3mDo+1tadAyyDZnJtH:DwqhjsPDRU3qogtEAyyDZ3H

Score
10/10
free cheetosquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Free Cheetos

C2

192.168.50.61:4782

Mutex

b9f33b8e-e35e-4e4c-aff8-7b28dddec418

Attributes
  • encryption_key

    6F5247E9D7D00C08CE63C6211A524818EA6DDA24

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • UPDATE!.rar
    .rar

    Password: ezfn

  • i - Copy (3).exe
    .exe windows:4 windows x86 arch:x86

    Password: ezfn

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections