Overview

overview

10

Static

static

10

Windows.exe

windows7-x64

10

Windows.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Windows-virus.zip

  • Size

    1.2MB

  • MD5

    e40fa1f36296d7a2d6727d29e79e569f

  • SHA1

    e5ef3afa225d7fa6c9a5268818e85af0cd84d92b

  • SHA256

    0167056e31996433544969f92a7bd0e79e44c4a56660e9c054b23ef0d707bf23

  • SHA512

    68b739369cd0a56d092eb62991a879a3679a74a47c2ac31a5a80aa1c2ef7dfcd26e5636ff57beb8c0c5be67b334c256f32d92a7d5ca227ccbd449809c302c0cf

  • SSDEEP

    24576:g6Iw4L6y5A9kY6wqxMsN2FrqbaQoiPOP5x2BDERcjbeKxnF4GH03j:TIw4JEV652FrfxD+Dzw

Score
10/10
pedoquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Pedo

C2

82.65.180.207:5986

Mutex

a4c2b814-ab22-4cf2-9f11-52931b6b15b3

Attributes
  • encryption_key

    6A4706C957DF851DA854AED16AB5CE4562B9C4D4

  • install_name

    serv-microsoft.exe

  • log_directory

    Logs

  • reconnect_delay

    4000

  • startup_key

    windows

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Windows-virus.zip
    .zip

    Password: virus

  • Windows.exe
    .exe windows:4 windows x86 arch:x86

    Password: virus

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections