Overview

overview

10

Static

static

10

app.exe

windows7-x64

10

app.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    app.exe

  • Size

    3.1MB

  • MD5

    a2019f0a72aa3207bbc5dcc49626d057

  • SHA1

    0a6a3183c5fd89143017bc62ed38fea832661fc7

  • SHA256

    4bbcd5f19331b84d284dd96729b893bb69ef30fa2d3097fd4ee8dda6953b60c6

  • SHA512

    4f826f86a9a958db71f4b5776a108aa4feb5d6afa17f6e51db93e67ce1851094591d49acf9d65f86f49986b265d8e5e266584893cdc009d8e1d3bdcb050b600b

  • SSDEEP

    49152:rvilL26AaNeWgPhlmVqvMQ7XSKGNRJ6EbR3LoGdaWTHHB72eh2NT:rvaL26AaNeWgPhlmVqkQ7XSKGNRJ6O

Score
10/10
kdotcryptquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KDOTCrypt

C2

us-east-65319.packetriot.net:22653

Mutex

1b077ba0-1574-4be1-aa2d-d6dbc0ef540a

Attributes
  • encryption_key

    92470F4731518ABFA77DC89068544FB7E7B7C459

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • app.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections