Overview

overview

10

Static

static

10

client_1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    client_1.exe

  • Size

    3.1MB

  • MD5

    6b77a49768be535c52b7851d94267986

  • SHA1

    da5b95e09f1307f8c86794f241667082d35a30ec

  • SHA256

    37e2000d6014f4aadd3ce9e666fe56950cc3a3664f8cafc60db7764e087f8916

  • SHA512

    f3d6abe0352047da8c531f8a0ba56ec4ebb96a55c8b92374f720324dc040e7754f0db756dd58f7e516358babb6b91e9ac79c97286e49ce8026b636cac89c8a54

  • SSDEEP

    49152:YvAt62XlaSFNWPjljiFa2RoUYIOQ0xNESEgk/izLoGd9THHB72eh2NT:Yvs62XlaSFNWPjljiFXRoUYIOLxb/

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

bore.pub:22550

Mutex

bb999b71-6352-4144-80ba-72dee1b1203d

Attributes
  • encryption_key

    741EA40283A4C5C802C55E59BD4F8B5785B0B44A

  • install_name

    csrss.exe

  • log_directory

    .logs

  • reconnect_delay

    10

  • startup_key

    Client Server Runtime Process

  • subdirectory

    .network

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • client_1.exe
    .exe windows x86

    Password: test123124124

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections