Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Client.exe

  • Size

    3.1MB

  • MD5

    e8776321f6d37da05901e9051f69d93f

  • SHA1

    88bb37d237039c2cc8805298aeecca25897d828b

  • SHA256

    768f3d3ab3cf8e3766320c4b21bf5d5b22c184eda22c2910a11ba225854b69f2

  • SHA512

    2df60e850fd8d5fdd420ea12c0465342dc6a935904aa364e072916e4b9da575cd495b9143fa69af4d2c18a7a8e717a42643f6d6304dcad9d70f4ebe1d49582b1

  • SSDEEP

    49152:/vzlL26AaNeWgPhlmVqvMQ7XSKnWRJ6AbR3LoGd+65THHB72eh2NT:/vpL26AaNeWgPhlmVqkQ7XSKnWRJ6au

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.4:4782

Mutex

fb60f788-23ad-4fe9-94ab-639b4ab81e3b

Attributes
  • encryption_key

    312C9735F1261D6EFAADF08B4DF3CC68E59E47DF

  • install_name

    ფოტოტესტ.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections