Overview

overview

10

Static

static

10

fhjgfutdcu...ct.exe

windows7-x64

10

fhjgfutdcu...ct.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fhjgfutdcuidudxoxixixyudtuddctuctct.exe

  • Size

    3.1MB

  • MD5

    0be9fad29e0b27d2b418265817618d08

  • SHA1

    3ceab68ab5de6d3542ec2a574dfaa906f4e3b611

  • SHA256

    6270216a0917518e451b68a50f0cba330771b22429c7b7795465c45688951740

  • SHA512

    64d3382960f48894807e7dc9b3d19fcf924f736d50c88dd149ba525112bbd4de757c789c3d87c8d87bc7d49c61f95de7e8a0a47b758f662e903389f8ad0195a9

  • SSDEEP

    49152:3vtt62XlaSFNWPjljiFa2RoUYI0rRJ6IbR3LoGdjTHHB72eh2NT:3vP62XlaSFNWPjljiFXRoUYI0rRJ6i

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

sense-null.at.ply.gg:14292

Mutex

36130c66-8856-4723-9587-329a9d9579c3

Attributes
  • encryption_key

    D161F17474FFDF2AAC9C9D3E14D5D05297F597C4

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    PORNHUB

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • fhjgfutdcuidudxoxixixyudtuddctuctct.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections