Overview

overview

10

Static

static

10

783e6ea626...2f.exe

windows7-x64

10

783e6ea626...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    783e6ea626cd72ba14c844f7de9cb57e6d56bb894aec3dbe223e81f065b2bc2f

  • Size

    2.7MB

  • MD5

    371d95abce192df7ac5648f4f954c456

  • SHA1

    f243994c2906525292b44b40e78aa0358589592f

  • SHA256

    783e6ea626cd72ba14c844f7de9cb57e6d56bb894aec3dbe223e81f065b2bc2f

  • SHA512

    6ef6bf42d47e3a5b4995ddd985c6726ffd1883ecbbf3c71f62511abc7d20fde208cd0371a3bcff54c855c253e1d483dd8a9ed2b661d734df3ac526a9514b3979

  • SSDEEP

    49152:uc4IZF1R2mztVOo6Ol9ureHIge8lDNlMdCKaGv2LkmNKUSW:uc4IZvR2mztVOo6Ol9uriIge8lP

Score
10/10
serviceonequasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

serviceone

C2

serviceofflineupdate.ddnsgeek.com:4782

Mutex

17af5434-027b-475c-85b6-fca637f3330d

Attributes
  • encryption_key

    F5275112E106580A140655595766AE270983F72B

  • install_name

    Chrome.exe

  • log_directory

    Logs

  • reconnect_delay

    6000

  • startup_key

    chrome update

  • subdirectory

    SubDir

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 783e6ea626cd72ba14c844f7de9cb57e6d56bb894aec3dbe223e81f065b2bc2f
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections