Overview

overview

10

Static

static

10

virusbomb.zip

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    virusbomb.zip

  • Size

    3.0MB

  • MD5

    52917c0a946305fc5559792a8bebf8bd

  • SHA1

    374d7c957fe6633c597e74e086ced767db328f36

  • SHA256

    56f01de80d010ece0209f6b266462b28305a4373b7d5fcafa0268d2f7e3921be

  • SHA512

    ed7f6c6efb52739fb25bdb34140a461b7ef6c80905055b9bb6527c63918982c1b31d1193c293d0c9f2428be1b2ad15fbc823f4d6ae5e3ad05aa2c92535d8218d

  • SSDEEP

    49152:/+PoMNvrqvm2lpQBHZyZTrw1YK7wyI1UcpRxSRIM2jePjiki3EAGPfj/KM2qTHT0:2g02rpuHZyZwR0yI1UuRxrNkNexkjiCE

Score
10/10
office04toxiceyequasar

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7584205709:AAHSbORjgixKBL3e_gW4a2nQGHA1HBwJVqY/sendMessage?chat_id=5569740835

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

riprealworld.ddns.net:4782

Mutex

6a893031-8f7c-4e00-9e79-83e39719887d

Attributes
  • encryption_key

    3388F603979BF351F677D18F04E7A89AEBEE7BE8

  • install_name

    Windows.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Toxiceye family
    toxiceye
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • virusbomb.zip
    .zip
  • TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Wargods.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • cs2go.exe
    .exe windows:6 windows x64 arch:x64

    4f2f006e2ecf7172ad368f8289dc96c1


    Headers

    Imports

    Sections

  • windows.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections