Overview

overview

10

Static

static

10

504f583f7c...ac.exe

windows7-x64

10

504f583f7c...ac.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    504f583f7c492b845e1cca28fa4eb8d7b2a6268ca72e21fc2d1c4c25a8c597ac.zip
  • Size 1.2MB
  • Sample240205-l8e4zafebr
  • SHA256 f72f013a0ede9354b092fb8e0f876e2190fffc2aa8a4d4f7a2691a8e25469c6d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
office04quasar

Malware Config

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 175.114.219.33:4782

Mutex

  • bf2755a1-ccc3-4e4b-a2e7-a25f639ba6c3

Attributes
  • encryption_key

    4A4B4ED5FC85E590C39406C6970DD75240497888

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 504f583f7c492b845e1cca28fa4eb8d7b2a6268ca72e21fc2d1c4c25a8c597ac.zip
    .zip 1.2MB
  • 504f583f7c492b845e1cca28fa4eb8d7b2a6268ca72e21fc2d1c4c25a8c597ac.exe
    .exe 3.1MB

504f583f7c492b845e1cca28fa4eb8d7b2a6268ca72e21fc2d1c4c25a8c597ac.zip

  • SHA256 f72f013a0ede9354b092fb8e0f876e2190fffc2aa8a4d4f7a2691a8e25469c6d
  • MD5 SHA1 SHA512 SSDEEP
Password
infected