Overview

overview

10

Static

static

10

Client-rat.exe

windows7-x64

10

Client-rat.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-rat.exe

  • Size

    348KB

  • MD5

    ec256c26130a04c9373508f4739e6873

  • SHA1

    e7c636bc332045559b74e64442669866cb05992a

  • SHA256

    498d58f134baad0c991626318b487d4c75c3134f7bd0702d49b98a996e8aaefc

  • SHA512

    146ba87ebdcbefdf5bb3e83ca0c8bf3882bba946059b3dcddba35bb1e51771c42387dc7c4f360f92cbe7b426b93787580046a1a1fc5aefdf8df7f4e6a2ef0599

  • SSDEEP

    6144:ymrqQ4i1FFiEK5hsyJJRaviTj9Tb3RbR6pN1kbEj71TaXLr3Ny:dpliv3iiTRfRbRO8bEv1Tghy

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

revolutionhacker-58546.portmap.io:58546

Mutex

QSR_MUTEX_tYdFddOewBIWzFWimD

Attributes
  • encryption_key

    E2Ofsbhc6PAT9kePOKdw

  • install_name

    server rat.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-rat.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections