Overview

overview

10

Static

static

10

Discord.exe

windows7-x64

10

Discord.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Discord.exe

  • Size

    3.1MB

  • MD5

    bedd5e5f44b78c79f93e29dc184cfa3d

  • SHA1

    11e7e692b9a6b475f8561f283b2dd59c3cd19bfd

  • SHA256

    e423c72ea1a279e367f4f0a3dc7d703c67f6d09009ed9d58f9c73dac35d0a85c

  • SHA512

    3a7924196830b52d4525b897f45feb52ec2aca6cd20437b38437f171424450fd25692bd4c67ccde2cf147f0ed6efcef395ea0e13b24f0cf606214b58cf8284de

  • SSDEEP

    49152:IvzlL26AaNeWgPhlmVqvMQ7XSKzFxNESEtk/iPLoGdVTHHB72eh2NTRR:IvpL26AaNeWgPhlmVqkQ7XSKBxgTE

Score
10/10
powerstealerquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

powerstealer

C2

192.168.56.1:4782

Mutex

6760d0e9-9df9-4aba-89be-4e5ce3e92cc8

Attributes
  • encryption_key

    057FCAF700E62ACFECC7338C474084AF9B47ABEB

  • install_name

    powerstealer.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Discord.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections