Overview

overview

10

Static

static

10

7b652915c4...eb.exe

windows7-x64

10

7b652915c4...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    85b177add44a49f07c6610191c064bbc.bin

  • Size

    1.2MB

  • MD5

    29eea6b9d0e2f052d46714885d5ea784

  • SHA1

    c40275f75032d4f8b6fa60bcdc71f57ac88326f4

  • SHA256

    66743ae3be6d419cec8ea33a6c265b1fad6eea2896d6f7bfaf981ee33df61e8a

  • SHA512

    68c7d25fe19d3790b64ce0fd2c55836940b6f12a9939b44018e4befc1efde8d725e0ca492c268b7f99ddc721f033c66f7e8670df961f3513896ac085678eaa09

  • SSDEEP

    24576:/Pg8YN4REglBDiaoAn1ogGxvc3QZULgvlztniGquR9TLZMAf:HZ04llJiaVnOgEU3QZ59zQGquLTLf

Score
10/10
rattedquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ratted

C2

localhost:4782

87.97.126.177:4782
Mutex

48887e39-00c3-4c7d-9fbd-aa9bee5b1a88

Attributes
  • encryption_key

    CD36E224C70A801E8033FBB0E5129B1EA712AE1D

  • install_name

    Windows Font Manager.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Font Manager

  • subdirectory

    Fonts

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 85b177add44a49f07c6610191c064bbc.bin
    .zip

    Password: infected

  • 7b652915c4539bf3c40a0700ca93c63e5fb1e56fdf0eb89567f7f0a8fb081aeb.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections