General

  • Target

    2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

  • Size

    534KB

  • MD5

    1e4df0eb1af664a6a5565f7c1d8d03c5

  • SHA1

    1334395725da44185b583b848de3a34d7a35ddc9

  • SHA256

    2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

  • SHA512

    e7845c88993974310626c9d126f92849e59529e7107c775a6536736b022992f8e1b581db323a75f7040ba4219da669f2fa899fa38cc14bcb0e4ab0ca1bbe9a73

Score
10/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

127.0.0.1:4782

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes
  • encryption_key

    QfW91vzgIrZEHqOOwPL3

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload 1 IoCs
  • Quasar family

Files

  • 2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097
    .exe windows x86