General
-
Target
1056690x000000000A3000000.dmp
-
Size
3.1MB
-
MD5
c6f114ae0e42190c98700f38c8002523
-
SHA1
060a4593844ec47e5712c3b756052a7d1f6fe045
-
SHA256
7072ada9f1f4f40c6a71c66a253c4b97e8bb44c572ab4a4930add313db6d3c78
-
SHA512
1fe309e617e67442176be98804248dc918eab7823bd5a87aa5aed921a769c7287ae717adc2bd78d6cdd61d0cf32a3542c6c5e4f14ad9eee1298e48f1f13206c2
-
SSDEEP
49152:ivvI22SsaNYfdPBldt698dBcjHngx/dBxWWoGdPgHTHHB72eh2NT:ivg22SsaNYfdPBldt6+dBcjHi/1
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
Unknown2131-55332.portmap.io:55332
Mutex
ceb31fe8-819e-4648-98b1-afd64c8cfa6a
Attributes
-
encryption_key
D43A8C9C8C9A74741CBEA4F1A01C53C2F8DF8AC2
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
wind
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1056690x000000000A3000000.dmp
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections