Overview

overview

10

Static

static

10

Client-built10.exe

windows7-x64

10

Client-built10.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built10.exe

  • Size

    3.1MB

  • MD5

    8b09b710cf79da2dbb54ac8548eee0ad

  • SHA1

    b75efaae2675e05f51337bb1380c38b692074656

  • SHA256

    f47017465588d49383d9bb5071956e251d4c2ab024270f97b6ba35a3e6e7dec8

  • SHA512

    92e08ed6248f7e25e630dcfdfadeac8ada8a402def03da2c74c1d69455a8f0262648cb3b14195ea8b7cb7e1de8e510f9fdff897017db9babb675eebd6e07feb5

  • SSDEEP

    49152:WvUt62XlaSFNWPjljiFa2RoUYIxC11JuAoGd/THHB72eh2NT:WvI62XlaSFNWPjljiFXRoUYIxCF

Score
10/10
kazekuquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

kazeku

C2

0.tcp.ap.ngrok.io:10431

Mutex

7fb11f4b-e530-407c-a46c-8834ab5c4f45

Attributes
  • encryption_key

    2E002E0BA1D95CECCDECD8F8B383C3F7C76A7FD7

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    kazeku

  • subdirectory

    kazeku

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built10.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections