General
-
Target
942e216bf41aea0642c7f219560630dc21d29219920e90be79e990e6387a3a9a
-
Size
3.1MB
-
MD5
c3e8ea545254bb9d01bff3f53668e04f
-
SHA1
84bfec02d33d829736407744504c271f71c21078
-
SHA256
942e216bf41aea0642c7f219560630dc21d29219920e90be79e990e6387a3a9a
-
SHA512
84933b3fc7a888673079c2fccf987189777fc20831eb76cc3f4b94cf960c0c74831b98892781f2e9053c97de7818922fd6a950a8aaccaf696903b536972f0b38
-
SSDEEP
49152:OUd1/DM2zv8aMlqCPwln5+Hjdh+Euvr9+VZzNAxoGnjwTHHB72eh2NTe:OUPrM2zEaMlqCPwln5+Ddh+Zvr4zq1k
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
rat1
C2
147.185.221.24:15249
Mutex
da67ff1b-f911-4ad4-a51c-c7c5bd13aeb3
Attributes
-
encryption_key
AB7A97D9E0F9B0A44190A0D500EAB7AF37629802
-
install_name
System32.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
System32
-
subdirectory
System32
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
942e216bf41aea0642c7f219560630dc21d29219920e90be79e990e6387a3a9a
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections