General
-
Target
7dfbc57a805e7eaa34652af8d62b3b5673518834c6cd04d9e92ab8240daffbd2
-
Size
3.1MB
-
MD5
d8dfca8f9764f8e3c11ae8c97de406e1
-
SHA1
dcff579895740aa0be13a5b168e0103d34fde86c
-
SHA256
7dfbc57a805e7eaa34652af8d62b3b5673518834c6cd04d9e92ab8240daffbd2
-
SHA512
55dc4190f7df08a3bcdad59c7c90ffa35943a1786c315cfd919f19a8051b9b0fe69d32532e176d81723c2578e1b17321f86ef913cc31f1309cc40a266f79d5c8
-
SSDEEP
49152:Zvft62XlaSFNWPjljiFa2RoUYI/4mImzbJoGdeEuJTHHB72eh2NT:Zv162XlaSFNWPjljiFXRoUYI/4mTuR
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
127.0.0.1:7777
Mutex
f9d96e52-a318-4957-8a2a-f5c28dc30d4d
Attributes
-
encryption_key
701AC1B06521646F02DA408E467374203AC09A44
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
7dfbc57a805e7eaa34652af8d62b3b5673518834c6cd04d9e92ab8240daffbd2
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections