Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Resubmissions

15-12-2024 23:39

241215-3ndh3svkbl 10

15-12-2024 22:49

241215-2rpj3sspaq 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    85b177add44a49f07c6610191c064bbc

  • SHA1

    7766290221b9dafd7c0d6d983070f55863ed1b26

  • SHA256

    7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb

  • SHA512

    0a4d7e6a5c3e2d63a92f2ae57ab68561f47e827edffea6ea83aebac8286aab886c3bd98c6e791222411d272a925e8b3e03e14dc1b1017aaa449c1b0674717798

  • SSDEEP

    49152:TvChBYjCO4Dt2d5aKCuVPzlEmVQL0wvwkaUEGiBeHLoVd2THHB72eh2NT:Tv8t2d5aKCuVPzlEmVQ0wvwf/Gp

Score
10/10
rattedquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ratted

C2

localhost:4782

87.97.126.177:4782
Mutex

48887e39-00c3-4c7d-9fbd-aa9bee5b1a88

Attributes
  • encryption_key

    CD36E224C70A801E8033FBB0E5129B1EA712AE1D

  • install_name

    Windows Font Manager.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Font Manager

  • subdirectory

    Fonts

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections