Overview

overview

10

Static

static

10

Clien6666t-built.exe

windows7-x64

10

Clien6666t-built.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Clien6666t-built.exe

  • Size

    502KB

  • MD5

    87e41f2ff925d117a9543b8418001fd1

  • SHA1

    dbc8531447f1ef41de2777a0b9fdafafef9ee159

  • SHA256

    b9b1fd131706460420a16297796157effa229ca995706559724f4850b21c3cb6

  • SHA512

    a96bbd1f86c86bfaab5b0e5ca7a20e29b0d36eed6f6de6f33cf9748664ed5e0025f94fdc8170e7a0b9376b09c4b9a8294a62c702ab513e5634869440d69e94b1

  • SSDEEP

    6144:dTEgdc0YIXAGbgiIN2RSBRHeHmKE6/Uzke5ocElOb8F9Rf8aZcTR3+:dTEgdfY6bgRGe21pzXcd+

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

rv0day47.ddns.net:4444

Mutex

3c50cea6-6bc5-4499-841f-f41dbf982f7a

Attributes
  • encryption_key

    B00E5BF264DF40C91419D18E0247EE506C70353C

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • Clien6666t-built.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections