Overview

overview

10

Static

static

10

2648-2232-...ry.exe

windows7-x64

2648-2232-...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2648-2232-0x0000000000400000-0x000000000044E000-memory.dmp

  • Size

    312KB

  • Sample

    230823-xw7t1agd9w

  • MD5

    84de3c3f811b936b626d525c4e4c4063

  • SHA1

    10170fc3b1e195bf0d790fefe01b980ed636b801

  • SHA256

    9467fd381c5c43fbc807d4f32323a1e9e22a0e7e6579c17f1fde647edc2a7746

  • SHA512

    11b396a9695d532243c61cf4222aa7fb760a96a4eb41f7dad78bbcd5447cb9b42b3ef4735a15bc830939dca4fabd6b68a7bd8156335c3d6eb0d630eb1ae3e8f9

  • SSDEEP

    6144:sKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkUC:vzCGL69zVGkllbkp

Score
10/10
quasaroffice04

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

185.238.3.205:6669

Mutex

4LDmiMPcrWXI3vcHed

Attributes
  • encryption_key

    M11R9prTigoaqxzXOSPw

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      2648-2232-0x0000000000400000-0x000000000044E000-memory.dmp

    • Size

      312KB

    • MD5

      84de3c3f811b936b626d525c4e4c4063

    • SHA1

      10170fc3b1e195bf0d790fefe01b980ed636b801

    • SHA256

      9467fd381c5c43fbc807d4f32323a1e9e22a0e7e6579c17f1fde647edc2a7746

    • SHA512

      11b396a9695d532243c61cf4222aa7fb760a96a4eb41f7dad78bbcd5447cb9b42b3ef4735a15bc830939dca4fabd6b68a7bd8156335c3d6eb0d630eb1ae3e8f9

    • SSDEEP

      6144:sKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkUC:vzCGL69zVGkllbkp

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks