Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    92942fe042869299c167566981ef4f34

  • SHA1

    f32067afd056f672e6b5747ef298a0f53489d24a

  • SHA256

    3035b8d8d8e716ca3112af35caaa496631185c4aa9d60450577516ad470a0f53

  • SHA512

    e1128cb8079ba21a35638d1811d26493856c0ce730fa20b2013c2305a0e72c8e3c119b00c0d19e1c410efa0f2c0652a5e8898816824a6d08b4bb1e7d1a3db4c6

  • SSDEEP

    49152:avGI22SsaNYfdPBldt698dBcjHucS01J/RoGdOTHHB72eh2NT:avL22SsaNYfdPBldt6+dBcjHucSW

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.1:4782

Mutex

560c734e-c4c0-47e7-be5e-0215bb96e9db

Attributes
  • encryption_key

    666CF2608FB9655A70EB1E0CB8B76FF837B96BD5

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections