Overview

overview

10

Static

static

10

44037f6c2f...f5.exe

windows7-x64

10

44037f6c2f...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44037f6c2fed815da4c59b50479561f5.exe

  • Size

    3.1MB

  • MD5

    44037f6c2fed815da4c59b50479561f5

  • SHA1

    f724de9954505061cd9f4fbe90bd57d8375ef6d1

  • SHA256

    59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553

  • SHA512

    e33bb327a8b8afc38bba20adfe4d00d99bd3772d65df1125796e5de00d02e37e8ea3a9ce48d16d5374343079d7addf8456c09b053ef9dfec35d183aaddfdf30d

  • SSDEEP

    49152:twAlUPhZwv68DkG17WlqTz5oqMn0f8bUlUUU+UUUZAMoAGdQTHHB72eh2NT:twsUPhZwv68DkG17WlqTzeqMn0fcK

Score
10/10
javaquasar

Malware Config

Extracted

Family

quasar

Version

1.4.2

Botnet

Java

C2

45.83.244.141:4782

Mutex

18dba2e6-0f3a-4d9f-b95d-78cbc696f514

Attributes
  • encryption_key

    88D5D2E6C33089786488A381589CC2587B1B6759

  • install_name

    $77-cmd.exe

  • log_directory

    $77-Logs

  • reconnect_delay

    1000

  • startup_key

    $77-cmd

  • subdirectory

    $77-SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 44037f6c2fed815da4c59b50479561f5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections