Overview

overview

10

Static

static

10

rararararararaaar.exe

windows10-2004-x64

10

rararararararaaar.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rararararararaaar.exe

  • Size

    3.1MB

  • MD5

    81a8b86d10e24aa1dce9abe78a6003e1

  • SHA1

    94b9154eef6c092ad539b57449a458ec0dfcd196

  • SHA256

    6f57eaa317afcb0a3ad48f011031de7e0a32057e55ccbeba6961f27f829e745a

  • SHA512

    51e8a74ecc49ce6218bfe59b7c01828c3e8c76af542c98dc5fd1a9f94157b4febd8c19995213390580f993f2f929e6139becf51e25b94404fdcad126cf39f395

  • SSDEEP

    49152:DvrI22SsaNYfdPBldt698dBcjHgERJ6hbR3LoGdgTHHB72eh2NT:DvU22SsaNYfdPBldt6+dBcjHgERJ6D

Score
10/10
roarquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roar

C2

lkjhblskhg-49405.portmap.host:49405

Mutex

5561e906-e428-4f00-a29e-9139fc28a77c

Attributes
  • encryption_key

    C5904FDD788EA00F921C538B9FE80C0B0A0DE728

  • install_name

    roar.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    discord

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • rararararararaaar.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections