Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Client-built.exe

macos-10.15-amd64

Client-built.exe

ubuntu-18.04-amd64

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    78f63956c7d225e0cdb217781f3e3804

  • SHA1

    5c7537dc34e0b31118af7f58bd81081dfb19a005

  • SHA256

    732f9ca83ed4e043ab84e80ae3e0fea8606d0ba856657778b90a46828fbb4a2a

  • SHA512

    bc2001ea4342d3578d99f52077ce72429a6a0cf74c8d21e419dbaa770db5d741f9a64a0422ecaec8175365364c38f572095ade248ea51f269903c358733ccd26

  • SSDEEP

    49152:avPY52fyaSZOrPWluWBuGG5g5hHhk9X4oGdATHHB72eh2NT:avg52fyaSZOrPWluWBDG5g5hHO9I

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

127.0.0.1:80

Mutex

dedc0c31-a9d5-4936-8439-f67307c1e91e

Attributes
  • encryption_key

    C6B9353E5E6A01413D610206CD154AF617832A54

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost.exe

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections