General
-
Target
QuasarApp.exe
-
Size
502KB
-
MD5
8f3416490a9880ff269cd0d74fea3a94
-
SHA1
fd47735724d772026e0f47f10e2791c5e266618c
-
SHA256
ba9844a7b9a7f14ce2dcb56ae90e986c2913f5837f3904130a114502dc6797ac
-
SHA512
1c79e174ca973325b3635b87f0718a752271517e3e65f7d7fedd5eab5706cbd7247401070ea582d77cdfdcf5f61098fcae4fe51a6059ec16435f88098723d474
-
SSDEEP
6144:cTEgdc0YpXAGbgiIN2RSB9NkF42btOLrp3P+QpocEDQb8F9K8c4ZT+5ZlsBscTRa:cTEgdfYlbghNwIFP0zTzZTUZSBscdK
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
Office04
C2
flingmodder-44266.portmap.io:44266
Mutex
c16cce68-0a86-440c-89b1-c088c1c8b4cb
Attributes
-
encryption_key
9BFDFBA45AE2C2C16DA4EEEA02438784B89CACC0
-
install_name
svchost.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
windows
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
QuasarApp.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections