Overview

overview

10

Static

static

10

2648-2232-...ry.exe

windows7-x64

2648-2232-...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2648-2232-0x0000000000400000-0x000000000044E000-memory.dmp

  • Size

    312KB

  • MD5

    84de3c3f811b936b626d525c4e4c4063

  • SHA1

    10170fc3b1e195bf0d790fefe01b980ed636b801

  • SHA256

    9467fd381c5c43fbc807d4f32323a1e9e22a0e7e6579c17f1fde647edc2a7746

  • SHA512

    11b396a9695d532243c61cf4222aa7fb760a96a4eb41f7dad78bbcd5447cb9b42b3ef4735a15bc830939dca4fabd6b68a7bd8156335c3d6eb0d630eb1ae3e8f9

  • SSDEEP

    6144:sKJuiyEnCGnhJlMP5Kq+SMv0VGb7bDcllbkUC:vzCGL69zVGkllbkp

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office04

C2

185.238.3.205:6669

Mutex

4LDmiMPcrWXI3vcHed

Attributes
  • encryption_key

    M11R9prTigoaqxzXOSPw

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2648-2232-0x0000000000400000-0x000000000044E000-memory.dmp
    .exe windows x86


    Headers

    Sections