General
-
Target
3056-59-0x0000000000400000-0x0000000000724000-memory.dmp
-
Size
3.1MB
-
MD5
47e0aa31d4093b9f7a7c9944aec37dd7
-
SHA1
3455be244b664db2b4dbe0a573a8da69c15d3035
-
SHA256
717755a24d443fceb8a8ced18b2fad5c539e94533cb36b699ea46a26bab7acfe
-
SHA512
a6114d8f46d5152d9032c7a7e13d368890e35a4a2ebbdc32c0cf4170a27024a2c8613d0796f3914602cb11dc8f24b53aab9f01d47ab9efbf137b7cb5169cfcce
-
SSDEEP
49152:TvqlL26AaNeWgPhlmVqvMQ7XSKYtBNL0tv0ouoGpTTHHB72eh2NT:TvSL26AaNeWgPhlmVqkQ7XSKY90C
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
1.tcp.eu.ngrok.io:29052
Mutex
16a0343a-339a-47b6-ae3c-9b9a37b0c064
Attributes
-
encryption_key
78845AEC980AAC2173E990F0E695BFC7CF6CD632
-
install_name
systemlogfiles.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
systemlogfiles.exe
-
subdirectory
systemlogfiles
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
3056-59-0x0000000000400000-0x0000000000724000-memory.dmp
Headers
Sections