General
-
Target
waasdfasdfa-cleaned.exe
-
Size
9.6MB
-
MD5
7a08b3d3a74cd47bdcb3de677069cc0e
-
SHA1
303280734566b299afa135056cce5576b5c48310
-
SHA256
6bf803ef550f4b654fe417656aa42d4a9bf467d96d99813deba7bd5bc6edb6f9
-
SHA512
19f1ebddaebe51c5cb71be9e1e0dd3edd403e973bd2ad171f96fa3ab08bc555896ab115e29d7ad794a6606cd18401e1b9ccf9eb2475b80b1ebc82ae1aae2008d
-
SSDEEP
98304:5+rEWXvUvUlSJSbWlOeAlKqTkNUv6mrV4/j0azLwlEwvJzWNCOhssO00:2/xSJSbWli5lSmZ4b0az+RiZi
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
v15.0 | Fifa23
C2
private123.duckdns.org:8808
dofucks.com:8808
Mutex
c398e98c-136e-4007-ab40-e179829f338c
Attributes
-
encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
-
install_name
.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
$sxr-seroxen
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
waasdfasdfa-cleaned.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections