Overview

overview

10

Static

static

10

352499d6c6...b9.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    352499d6c65b813492539fe98a61a5bf798e7c53b1363d3f7ba47365fec374b9.zip
  • Size 331KB
  • Sample261112-mdncjaef53
  • SHA256 a92ebdfa501d20c217cdd752e55903379329ec19c7a89db05a529e4bbff8e925
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
you found metrojanspywarequasar

Malware Config

Extracted

Family

  • quasar

Version

  • 1.7.1

Botnet

  • you found me

C2

  • 127.0.0.1:4782

Mutex

  • c16fc9de-3ab0-4e06-b1fd-325b132d44c5

Attributes
  • encryption_key

    D2973F3069489602440049C54C37809627555190

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Modded Client Startup

  • subdirectory

    SubDir

Signatures

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 352499d6c65b813492539fe98a61a5bf798e7c53b1363d3f7ba47365fec374b9.zip
    .zip 331KB
  • 352499d6c65b813492539fe98a61a5bf798e7c53b1363d3f7ba47365fec374b9.exe
    .exe 709KB

352499d6c65b813492539fe98a61a5bf798e7c53b1363d3f7ba47365fec374b9.zip

  • SHA256 a92ebdfa501d20c217cdd752e55903379329ec19c7a89db05a529e4bbff8e925
  • MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected