General
-
Target
f0b2e93939fa8e8ef3831554a9fbfca80f8c37f39c27d4296aa5cc77da6200a9
-
Size
3.1MB
-
MD5
07bc9f64364b0713f22ec9bf5f0cb3af
-
SHA1
3106f5d042d04b0b10b71ea4819163a4cc2380f6
-
SHA256
f0b2e93939fa8e8ef3831554a9fbfca80f8c37f39c27d4296aa5cc77da6200a9
-
SHA512
eb51f8a5dc9824745f192510e480cb312e55c5bcfcefe24e003ee49d714558f834c19312f05d170f944c72b5d1228b19b54d501d9d0eeaced6ba9aca6f5a3958
-
SSDEEP
49152:SvVcIC2SsaNYfdPBldt698dBcjHJxcEf8Tk/JaSoGdzb0XHHB72eh2NT:SvnC2SsaNYfdPBldt6+dBcjHJxx7
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
120.25.239.25:59823
Mutex
8e2edf14-dcaf-403d-ab35-067023ce866a
Attributes
-
encryption_key
BF14D97A073A6E69BADC1696EECD7763E3598D7B
-
install_name
System32.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
System32 Client Startup
-
subdirectory
System32
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f0b2e93939fa8e8ef3831554a9fbfca80f8c37f39c27d4296aa5cc77da6200a9
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections