General
-
Target
09ddb72db5aca188c18f0b0029e1a7540ada19945ff8f9432789f8caabd2994c.exe
-
Size
3.1MB
-
MD5
2eccc4e4fbd79ae24eccd009dac2887f
-
SHA1
41a496a6ace4861549b78630e9b8423155b4f4d6
-
SHA256
09ddb72db5aca188c18f0b0029e1a7540ada19945ff8f9432789f8caabd2994c
-
SHA512
08ed204a7cd266b34e3b68534f0b4ef201f28ba4604a83ea2e7e67b236cbae7fbaf84b742d1860c9d692a3b4ec1b3b15cab60b4f222b3eeb513c5025beb5d73f
-
SSDEEP
49152:PvbI22SsaNYfdPBldt698dBcjHeIIjhZFoGdvJZTHHB72eh2NTk:Pvk22SsaNYfdPBldt6+dBcjHeIS/z
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
blackhat
C2
blackhattr.ddnsfree.com:4782
Mutex
ae8339a7-3385-49fb-9163-5491d3ba7727
Attributes
-
encryption_key
82CD386E2BDAC124642E3EFA99734071C9C7F79C
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
09ddb72db5aca188c18f0b0029e1a7540ada19945ff8f9432789f8caabd2994c.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections