General

  • Target

    1fea532c75a33209f094f835261b4f579613a7b2ece7f046a11309d34537f8d5

  • Size

    3.1MB

  • MD5

    e606a8d90dc0458e72508b428e950038

  • SHA1

    5ca61eaf0e2d26e1cf70ff2da183440fe2792081

  • SHA256

    1fea532c75a33209f094f835261b4f579613a7b2ece7f046a11309d34537f8d5

  • SHA512

    e0b0a4c33f9256415802beed59913b3db9b02b146eebd9f599abfd2099dc5a4695e2163c6b5a481ff6f52e68173463347b4cd2e5e238a01f75c0c06a79c04dc4

  • SSDEEP

    49152:evlt62XlaSFNWPjljiFa2RoUYItiRJ6CbR3LoGdWTHHB72eh2NT:evX62XlaSFNWPjljiFXRoUYItiRJ68

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

41.216.183.22:4782

Mutex

73d47cb4-df1b-4a92-9966-ab4a6e59fac1

Attributes
  • encryption_key

    9BB10B12B951D4020613CEC9F1D40DD2EE861BD7

  • install_name

    Office365.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Office365

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1fea532c75a33209f094f835261b4f579613a7b2ece7f046a11309d34537f8d5
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections