General
-
Target
testating.exe
-
Size
502KB
-
MD5
1f8f68e7623630103601f6235e9c94a6
-
SHA1
3c32c376b1be12d1f9df117eb8435804548c02c8
-
SHA256
76257feb8d753a419e11bd0672eac3d236ac990d8ba8baf7ec44c5f1f3eac591
-
SHA512
c93ba03f50602919a8355334c1450fb9f57aeb432027e53c458195d7dfbdc3940d042e136eb3ace24cd76c1ffbd359be05582893fc0e53f5fe764c8c32fe6631
-
SSDEEP
6144:4TEgdc0YHXAGbgiIN2RSBWDR3Uz8sXKYF8MtcEnOb8F96rQ3u49JTxcTR32:4TEgdfYfbgnttr3pcreu4nTxcd2
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
Office04
C2
192.168.1.237:1290
Mutex
0cdb9102-24f8-4ed6-ba0c-d7625d69d684
Attributes
-
encryption_key
63E6BFBD5330A53154091A63A8847C4FAA484D23
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
2899
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
testating.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections