Overview

overview

10

Static

static

10

exacag.exe

windows7-x64

10

exacag.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    exacag.exe

  • Size

    3.1MB

  • MD5

    42994901f5bc8b43588bb54889f1db81

  • SHA1

    bc4e4fd8cb12e302301fa39fdbbb0f48d914fb85

  • SHA256

    129dbf173e38d9d37f8c66513290a30bc0790e9fdcdb5c9043a399ee6c889493

  • SHA512

    783970fc5d868ccb7f1d346acbcc82206df9c0c893162588f47dc93aa1ee457330d7c7e469a7e3d13c9bd8bca4bcbc6201c9ff2828aa50e4da7bd50134c7b3d1

  • SSDEEP

    49152:7vNG42pda6D+/PjlLOlg6yQipVtoS71JZ3oGdpTHHB72eh2NT:7vk42pda6D+/PjlLOlZyQipVtoSp

Score
10/10
sigortaquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Sigorta

C2

0.0.0.0:7777

13.48.129.198:7777

172.31.0.240:7777
Mutex

3b0592fc-14a1-4b8e-9803-69284ea2b6d2

Attributes
  • encryption_key

    E0BB4B221F7AADA73B9059B33A3CFF096A518413

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • exacag.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections