Overview

overview

10

Static

static

10

Vision.exe

windows7-x64

10

Vision.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Vision.exe

  • Size

    3.1MB

  • MD5

    226da7bdcf31d3821b48524192078cca

  • SHA1

    dc3af8e9cc4866922ce5fd802a96a3981b616809

  • SHA256

    fed985df01d7b610cdfae43ad290aef5fc01ae5a052fe599ea31d9451536ad21

  • SHA512

    bf426582ceb5fefdbe09396ed48f88b655e1bb84b1082bcc5e72df24b47558a39a83403136a5608dece227cda5c4fd9e1ecb8aabf2193a21f91d132a271dc6d7

  • SSDEEP

    49152:evAt62XlaSFNWPjljiFa2RoUYIKPwYbR03LoGdHG+THHB72eh2NT:evs62XlaSFNWPjljiFXRoUYIKPwjbX

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.80:4782

Mutex

051d859a-efdc-48d2-9c8d-74855fef4f81

Attributes
  • encryption_key

    0F1F3A5607006AB737BEF11D409223FCD4907812

  • install_name

    Microsoft.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Microsoft

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Vision.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections