Overview

overview

10

Static

static

10

7697ebe5ea...40.exe

windows7-x64

10

7697ebe5ea...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

  • Size

    502KB

  • MD5

    16db55265ceb495867c35c68a1b672ab

  • SHA1

    1b18cb285e91c3f9c78f4f3a18a8baf5df6b6fc4

  • SHA256

    7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40

  • SHA512

    bc4dde6ef69c606753d05fd303b0385d5dec303ce2b399de37e29dd2c085c53e47309381f34b503f87d27a66420c1c21ba8c98c81490c3614f679b8bfc034a6d

  • SSDEEP

    6144:MTEgdc0Y5ebGbXOsA6j1RdhQA3CpXJ9J6jFivvvcE6Ob8F9ogRXOc0UblHcTR36:MTEgdfYhA6bGqKKpNeYlHcd6

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

eggsbenedict.onthewifi.com:2448

Mutex

047fff9d-5ae7-4a17-a172-45ccd40ba62f

Attributes
  • encryption_key

    28D26D97888ABDC848F4C65C4EE630CCEF1C1B67

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • 7697ebe5ea4766b1653f58aa24327679b35fa917877568238ac306a913289b40
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections