General
-
Target
7c99ac6c7825f1d7ce557dab741583a7.exe
-
Size
502KB
-
MD5
7c99ac6c7825f1d7ce557dab741583a7
-
SHA1
1532d8a9fa4ce1baba8e8d9546562d49cbaf7c78
-
SHA256
a0da9ef618a2cce1f0f683b46298972d24137ed70b1c40e8a5248e234b1a15b0
-
SHA512
9cda9308835cac213777cf5eddf2a5bfe5500f4a8633404940f91a3e3e5274f5b893bef5e7ebef4bc8881072daa5816a1d3d1f2c05ab4d36c5a3cc045d6af18e
-
SSDEEP
6144:9TEgdc0YNX7IxUpGREWKiczHV08HDFHfJhM2cEOEb8Fp56RED2TrEucTR3e:9TEgdfYWxUZHTlfJVePS+2HEucde
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
Office04
C2
75.127.254.214:4782
Mutex
38d93274-c24f-457c-b59d-1edd15bc1eb9
Attributes
-
encryption_key
4A23179249B1FA855597F4F82EB997F23C26B614
-
install_name
winlogon.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
winlogon.exe
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
7c99ac6c7825f1d7ce557dab741583a7.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections