General

  • Target

    1f8f68e7623630103601f6235e9c94a6.bin

  • Size

    229KB

  • MD5

    1d47eed56c4d28b3d42c1c0b835bbd2d

  • SHA1

    e999ea108fd6b36ffa384a65f55e9567906e93e7

  • SHA256

    e51a6cc27a8e9f21f56404bcf479978db71825bd61ed6eaf4570b5d64edbe2a2

  • SHA512

    a7b339f6cafb5d959cef245e4ea938ae319c7ce05a4f862a463ecd2d9a7b7d9a7c86c74068b8a984d2880de8d03b95a07511ad4ff7ef36c2004a28d0dc1d0ac6

  • SSDEEP

    6144:w6jdLkH/t+Lq0A0N+ue+3Y5soGZHOg7DIUnNjBT/fEV4K6XkK:w6hLksq+Xo5GZHOgHJTnEVrEr

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.1.237:1290

Mutex

0cdb9102-24f8-4ed6-ba0c-d7625d69d684

Attributes
  • encryption_key

    63E6BFBD5330A53154091A63A8847C4FAA484D23

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    2899

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs

Files

  • 1f8f68e7623630103601f6235e9c94a6.bin
    .zip

    Password: infected

  • 76257feb8d753a419e11bd0672eac3d236ac990d8ba8baf7ec44c5f1f3eac591.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections