Overview

overview

10

Static

static

10

26aba4e9a0...88.exe

windows7-x64

10

26aba4e9a0...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    26aba4e9a028a23c065ce9611c164288.exe

  • Size

    2.8MB

  • MD5

    26aba4e9a028a23c065ce9611c164288

  • SHA1

    58bc1e70429c58615863e1704d3a6b575fab767f

  • SHA256

    00e3eebe4bbea52843a8d335bdf5e4b5d6c8de8079f8d86a345cceb2375ccb25

  • SHA512

    0db32f58a5d54d04bd3ca60111b3963a50741893a16325a2f3bbeba237fc280fa6f3c63d054d5b9cef0443e8e5ed1de38e4a459c3e7f0c3be4d0a054e08b5095

  • SSDEEP

    49152:ZfjG7SXx1c7V1tgRk5ysKxqEDtIupA7f/za32ehyfT36Dq2w:ZfSSB1c7V1yypKxq1ubw

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

39.107.242.96:47820

Mutex

fda87a73-83f3-4200-85c4-d2289eb5f51f

Attributes
  • encryption_key

    38F957A7714EBE6FC27E56C6EAB8BADC987F5E2B

  • install_name

    Windows Search.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    WindowsSearchPrograms

  • subdirectory

    WindowsSearch

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 26aba4e9a028a23c065ce9611c164288.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections