Overview

overview

10

Static

static

10

1912-74-0x...ry.exe

windows7-x64

1912-74-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1912-74-0x0000000000400000-0x0000000000724000-memory.dmp

  • Size

    3.1MB

  • MD5

    2d9edb6984bbae228680fdb24ff09f3e

  • SHA1

    6b3d39b4304fa37c6b31c1b59ce6be10c119eddc

  • SHA256

    b2446d9bc1c74e2c69b52c617ec338f0fcb69f3076231b429741aaed798219f6

  • SHA512

    ce9751a3d9157dfd0cd962180c4ff6f6acb09e989469869cba1fdd384d3c07c2154c334abce351a7089861abf3813774b0400727d6da4cac202a56d47dc81b32

  • SSDEEP

    49152:HvvI22SsaNYfdPBldt698dBcjHQeRJ6ZbR3LoGdGTHHB72eh2NT:Hvg22SsaNYfdPBldt6+dBcjHQeRJ6b

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Unknown2131-55332.portmap.io:55332

Mutex

ceb31fe8-819e-4648-98b1-afd64c8cfa6a

Attributes
  • encryption_key

    D43A8C9C8C9A74741CBEA4F1A01C53C2F8DF8AC2

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    wind

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1912-74-0x0000000000400000-0x0000000000724000-memory.dmp
    .exe windows x86


    Headers

    Sections