General
-
Target
32aa4355cbed96bc5f95b9e18425fcfa9e3191007e13e2e6764eb8355f276c8d.exe
-
Size
3.1MB
-
MD5
11d348c5e9794db430c8258037e755a8
-
SHA1
9f38e40e8aca0490d248c3cd4d0cd3443cba9a0f
-
SHA256
32aa4355cbed96bc5f95b9e18425fcfa9e3191007e13e2e6764eb8355f276c8d
-
SHA512
480aef06b1da8a6409c8a00063921d821d4dcb69a2bfd4b839ecb817334f01aec133739be93f6231a52cd194f1983f6663bfb59881e58bfda39bdc436ca116fb
-
SSDEEP
49152:uvvI22SsaNYfdPBldt698dBcjHenRJ6jbR3LoGdO9sJTHHB72eh2NT:uvg22SsaNYfdPBldt6+dBcjHenRJ6V
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
1800hacker.ddns.net:4782
Mutex
67ffd655-49fa-469d-a213-f509adc8ddd2
Attributes
-
encryption_key
35F8929B1F55E71F320F40E14B86BDA0FE83A2AB
-
install_name
Feather.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
32aa4355cbed96bc5f95b9e18425fcfa9e3191007e13e2e6764eb8355f276c8d.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections