Overview

overview

10

Static

static

10

exacag.exe

windows7-x64

10

exacag.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    exacag.exe

  • Size

    3.1MB

  • Sample

    250204-gj9j3ayqbr

  • MD5

    42994901f5bc8b43588bb54889f1db81

  • SHA1

    bc4e4fd8cb12e302301fa39fdbbb0f48d914fb85

  • SHA256

    129dbf173e38d9d37f8c66513290a30bc0790e9fdcdb5c9043a399ee6c889493

  • SHA512

    783970fc5d868ccb7f1d346acbcc82206df9c0c893162588f47dc93aa1ee457330d7c7e469a7e3d13c9bd8bca4bcbc6201c9ff2828aa50e4da7bd50134c7b3d1

  • SSDEEP

    49152:7vNG42pda6D+/PjlLOlg6yQipVtoS71JZ3oGdpTHHB72eh2NT:7vk42pda6D+/PjlLOlZyQipVtoSp

Score
10/10
quasarsigortaspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Sigorta

C2

0.0.0.0:7777

13.48.129.198:7777

172.31.0.240:7777
Mutex

3b0592fc-14a1-4b8e-9803-69284ea2b6d2

Attributes
  • encryption_key

    E0BB4B221F7AADA73B9059B33A3CFF096A518413

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      exacag.exe

    • Size

      3.1MB

    • MD5

      42994901f5bc8b43588bb54889f1db81

    • SHA1

      bc4e4fd8cb12e302301fa39fdbbb0f48d914fb85

    • SHA256

      129dbf173e38d9d37f8c66513290a30bc0790e9fdcdb5c9043a399ee6c889493

    • SHA512

      783970fc5d868ccb7f1d346acbcc82206df9c0c893162588f47dc93aa1ee457330d7c7e469a7e3d13c9bd8bca4bcbc6201c9ff2828aa50e4da7bd50134c7b3d1

    • SSDEEP

      49152:7vNG42pda6D+/PjlLOlg6yQipVtoS71JZ3oGdpTHHB72eh2NT:7vk42pda6D+/PjlLOlZyQipVtoSp

    Score
    10/10
    quasarsigortaspywaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks