General

  • Target

    tmppenjc48f

  • Size

    3.1MB

  • Sample

    231117-wawzyada4v

  • MD5

    6401526837d35c83f00cc20d2d387083

  • SHA1

    463821949c73ec31b8841c00bb44a1df79ed20c5

  • SHA256

    caf572b1ea51e044b92d1e37c6ee9f8bf4dd178cf6c71cff5a3527c7870a397b

  • SHA512

    70a89fd3c03888ca78ebd5323626a68a0f4555dc1247a87a72c8b7ef809dcb8ce626eff1e42e2f0aded983266ef512d995f301ebaad154275ed96123d5da34d7

  • SSDEEP

    49152:KvWI22SsaNYfdPBldt698dBcjHUPX/1BxRgoGdFuTHHB72eh2NT:Kv722SsaNYfdPBldt6+dBcjHM/I1

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

193.161.193.99:58530

Mutex

54af0e48-5a33-4746-8a98-01dcf13783ba

Attributes
  • encryption_key

    3A62B341BAB9ECBB32B7C8FEE43F79FE46244413

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      tmppenjc48f

    • Size

      3.1MB

    • MD5

      6401526837d35c83f00cc20d2d387083

    • SHA1

      463821949c73ec31b8841c00bb44a1df79ed20c5

    • SHA256

      caf572b1ea51e044b92d1e37c6ee9f8bf4dd178cf6c71cff5a3527c7870a397b

    • SHA512

      70a89fd3c03888ca78ebd5323626a68a0f4555dc1247a87a72c8b7ef809dcb8ce626eff1e42e2f0aded983266ef512d995f301ebaad154275ed96123d5da34d7

    • SSDEEP

      49152:KvWI22SsaNYfdPBldt698dBcjHUPX/1BxRgoGdFuTHHB72eh2NT:Kv722SsaNYfdPBldt6+dBcjHM/I1

MITRE ATT&CK Matrix

Tasks