General
- Target vixen.exe
- Size 1.9MB
- Sample250802-sfsb6aam4x
- SHA256 3637ca34ceee7b2a404aad80b80ac2e5da7ec008f03d55fa2ad662f5c93378f3
- MD5 19bbb99253f9b87740ffee39d85eb931
- SHA1 c9c2b6fe04f9bf21aad061c5776367b3149d7553
- SHA512 4cd7737cae50e49e9dd5c5fa97a5426a115e6a706b344bd0dc2c21d6533ea8c2ae85e5acb18fcf0e21a4e5c19eae934bcb33aab4550b3638e5308c3fba80ddd7
- SSDEEP 49152:vrZuw7rRFirm+Nn42KK8i7Ltwa+VVaSdT:vrZueavNnoK8i7LtwbHJd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
1.6.6
Botnet
-
vixen
C2
-
kecfcnyn-29266.portmap.host:29266
Mutex
-
4c439422-0ff5-4a27-9336-4174fdb1b4a9
Attributes
-
encryption_key
D3B318DCCDC58642A922C0AE651BC1AE46A4E0CB
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
pulsar
-
reconnect_delay
3000
Targets
-
- Target vixen.exe
- Size 1.9MB
- SHA256 3637ca34ceee7b2a404aad80b80ac2e5da7ec008f03d55fa2ad662f5c93378f3
- MD5 19bbb99253f9b87740ffee39d85eb931
- SHA1 c9c2b6fe04f9bf21aad061c5776367b3149d7553
- SHA512 4cd7737cae50e49e9dd5c5fa97a5426a115e6a706b344bd0dc2c21d6533ea8c2ae85e5acb18fcf0e21a4e5c19eae934bcb33aab4550b3638e5308c3fba80ddd7
- SSDEEP 49152:vrZuw7rRFirm+Nn42KK8i7Ltwa+VVaSdT:vrZueavNnoK8i7LtwbHJd
- MD5 SHA1 SHA512 SSDEEP
-
Quasar family
-
Quasar payload