Overview

overview

10

Static

static

10

e3d17377d5...de.exe

windows7-x64

10

e3d17377d5...de.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b48f94c872bb4e3596924f7f587b0a54.bin

  • Size

    1.2MB

  • MD5

    e6cdd20dda09c4ae01e6c3938ee92349

  • SHA1

    2c9b8ebc444a0bcdd2fc3d1b3079d6a0b18e77bf

  • SHA256

    4d358d8b4798bbc28617acdd1a39a820a94bb08f954f69ad1659c1d8c0767ca6

  • SHA512

    cdf6b8a1cf740828f27c80a02e8e11e5a33f05349c855034c5008b0bb599443a3985d59c47bd7014a4e0bd2e82f5ce951a54e6380ca1d5b669040ff239f3addc

  • SSDEEP

    24576:7xAY0nIlPjw8ffys3p+DHSo1MzFBWI9ackXYVVX59u9zBWJnx5AbjNE:7H+IBjBfPZ+DyFFBZaHXo9u0JnD2pE

Score
10/10
minerquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Miner

C2

154.216.19.144:7000

Mutex

9aaccf69-ec3a-44b7-854b-ecd43ee8e151

Attributes
  • encryption_key

    4A883D3FC8F269324ACDCF0E4B7FFECA042CD47D

  • install_name

    Svc.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Svc

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b48f94c872bb4e3596924f7f587b0a54.bin
    .zip

    Password: infected

  • e3d17377d59312e36a5e3b503a7259ffeaac4dd742222be0ad9a8ea443d3f7de.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections