Overview

overview

10

Static

static

10

092efd70b0...fb.exe

windows7-x64

10

092efd70b0...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    092efd70b090bbfc0af8facff15b06f818ebfa87a1b4034abf7e0b749bc079fb.exe

  • Size

    3.1MB

  • MD5

    7b3cdbe64809334591697b1424193cdc

  • SHA1

    489dc1a891a4eca75df696a5c139e991277be9c7

  • SHA256

    092efd70b090bbfc0af8facff15b06f818ebfa87a1b4034abf7e0b749bc079fb

  • SHA512

    811eb77ba66402dbf8ccbeacae131d36b0a97b7c813d335819d96370f904ffd7a6c9b2410f47fc2f0eac43675849e6b3473ab56ecfa0d934e97dbdc8b3e4fb74

  • SSDEEP

    49152:zvelL26AaNeWgPhlmVqvMQ7XSKjizD+YMfrDoGdfTHHB72eh2NTt:zvOL26AaNeWgPhlmVqkQ7XSKjizD+LQ

Score
10/10
roarquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

roar

C2

fojeweb571-59106.portmap.host:59106

Mutex

0c203952-83f0-40e8-a93c-b701163cc930

Attributes
  • encryption_key

    B42CE86AEBA4D8818352F4D811EA7BBB472E229A

  • install_name

    windows defender.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    discord

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 092efd70b090bbfc0af8facff15b06f818ebfa87a1b4034abf7e0b749bc079fb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections