Overview

overview

10

Static

static

10

CMMON32.exe

windows7-x64

7

Client-built.exe

windows7-x64

10

CraxsRatV7.6.exe

windows7-x64

3

FivemCheat.exe

windows7-x64

10

QuantumBuilder.exe

windows7-x64

10

R2Tf11dq2.exe

windows7-x64

10

System.exe

windows7-x64

10

kinginamoV2.exe

windows7-x64

10

robloxfisc...st.exe

windows7-x64

10

robloxlist.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Junk.rar

  • Size

    11.0MB

  • MD5

    42370a4af1848fadb8e94bafee10d0b4

  • SHA1

    19dcea73c071fc0e15c6995ed02c364ad8be7be2

  • SHA256

    600920f492a2bed6dd636efa706f7b7fde6043e3189156281ef3a9fbca534180

  • SHA512

    8032bad0e860faa05da5ac6b4cf802bc5cef8e9b4114237b72ca4f0fd3dfb42c95ad175a33005735b349f454fc467ea04441ee2703815a87b03ab227cbb4ac65

  • SSDEEP

    196608:lQsEnsAdjZySrZMV2tc1BmYcx/FcyiT5mcCX076S4bS4uimLLcDOWdeGiXTV9AZD:lQsEsGFM0tc1Dcx/FCnb0HmfcDO7p9A9

Score
10/10
office04fivemcheat5botnetclintquasarmetasploit

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.230.182:5555

Mutex

63b26182-49d1-4b12-9435-8f7347beb179

Attributes
  • encryption_key

    980452E0925440E50CD776FEC70DFCE8D257B2C7

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

FivemCheat5

C2

192.168.1.12:1234

Mutex

1a903210-dd7d-4b58-a38f-bf1da0e142cf

Attributes
  • encryption_key

    BA39EAF72B9F53A37268DA8C4407CF8E66D97AB3

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

botnet

C2

165.227.31.192:22069

193.161.193.99:64425

193.161.193.99:60470
Mutex

713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes
  • encryption_key

    684009117DF150EF232A2EE8AE172085964C1CF0

  • install_name

    System.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Office

  • subdirectory

    Winrar

Extracted

Family

metasploit

Version

metasploit_stager

C2

138.68.79.95:19040

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Clint

C2

192.168.178.29:4780

192.168.178.29:4782
Mutex

QSR_MUTEX_02VEKG7zCDubNpN0wF

Attributes
  • encryption_key

    Bdex5bWk923mG5O2SXnn

  • install_name

    robloxfisch.exe

  • log_directory

    Log

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Metasploit family
    metasploit
  • Quasar family
    quasar
  • Quasar payload 6 IoCs
  • Unsigned PE 10 IoCs

    Checks for missing Authenticode signature.

Files

  • Junk.rar
    .rar
  • CMMON32.exe
    .exe windows:5 windows x86 arch:x86

    9222d372923baed7aa9dfa28449a94ea


    Headers

    Imports

    Sections

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • CraxsRatV7.6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • FivemCheat.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • QuantumBuilder.exe
    .exe windows:5 windows x86 arch:x86

    2cc68961dd8a09287e908343d46b30d4


    Headers

    Imports

    Sections

  • R2Tf11dq2.exe
    .exe windows:5 windows x86 arch:x86

    9222d372923baed7aa9dfa28449a94ea


    Headers

    Imports

    Sections

  • System.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • kinginamoV2.exe
    .exe windows:4 windows x64 arch:x64

    b4c6fff030479aa3b12625be67bf4914


    Headers

    Imports

    Sections

  • robloxfischscriptlist.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • robloxlist.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections