Overview

overview

10

Static

static

10

874dc85b74...f5.exe

windows7-x64

10

874dc85b74...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe

  • Size

    3.1MB

  • MD5

    c965446805dc5c40e1bffe859716bea7

  • SHA1

    7d6b257f8f830f512552bd11b36bb1fc88a1e966

  • SHA256

    874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5

  • SHA512

    157b7d59cb94d83dceba138207f1d335df6f9da90c510cbad8e0b252173be05679352de83d2aef2e3ae3d7de58f7253f93422b44680d2cb63e6c3640fd68233b

  • SSDEEP

    49152:bv1I22SsaNYfdPBldt698dBcjHQFwGSBe1LoLdfTHHB72eh2NT:bve22SsaNYfdPBldt6+dBcjH5GD

Score
10/10
prudabackendquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

PrudaBackend

C2

45.131.108.110:4782

Mutex

8f8e6059-ac4f-4e47-8d62-3ce070083ecf

Attributes
  • encryption_key

    D82EC4913FC5B28DDFF5AC48635D190A9342C6BD

  • install_name

    update.exe

  • log_directory

    Logs

  • reconnect_delay

    2500

  • startup_key

    Runtime Broker.exe

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 874dc85b74f8ee6a116d38453078905ee487949425e97a42de9b258dd6b8bbf5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections