Overview

overview

10

Static

static

10

hrar.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    hrar.exe

  • Size

    3.1MB

  • MD5

    b6ff996e501652ecd561639bcf8c7b65

  • SHA1

    d59eb31de4eb86fd1eb395f4e1c7fc52082c2fe6

  • SHA256

    d4e8227cf61346d7264be4f1f184898cdf84c465e622e9683993d3dcf33c4945

  • SHA512

    040ef39bc0206eccccc1b1a4af8cc46f64ed480333893ea4f5c55701ea50ca34d7c64acf7dcc08fde119cc636f9c2842715cb145b71054bccc8c42ec5fca545d

  • SSDEEP

    49152:PvelL26AaNeWgPhlmVqvMQ7XSKcORJ6abR3LoGdl3THHB72eh2NT:PvOL26AaNeWgPhlmVqkQ7XSKcORJ60V

Score
10/10
roarquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roar

C2

fojeweb571-45302.portmap.host:45302

Mutex

55e529e2-c08e-4693-b5fc-9b2c7f622871

Attributes
  • encryption_key

    B42CE86AEBA4D8818352F4D811EA7BBB472E229A

  • install_name

    windows defender.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    discord

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • hrar.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections