Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cl.exe

  • Size

    3.1MB

  • MD5

    4cdf8f1c79b75f8bb6c7518a93e9ab4b

  • SHA1

    33b8f93aec750713c8488ce80d857a2c760e9dd9

  • SHA256

    48b86c090f6073dfc15faf14c09694c88386d36f8c046010d7e3329b3a6db14d

  • SHA512

    30d4b373f3209837ce7b63b975b2b51d9a32842e6c469345b103465c003def242a7e759393f65c60dd399421c237bb80fabd2c2bb5f8d10c61c7c322f625015c

  • SSDEEP

    49152:mvOI22SsaNYfdPBldt698dBcjH3UxNESEIk/ijLoGdwWTHHB72eh2NT:mvj22SsaNYfdPBldt6+dBcjHExDv

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

0.tcp.eu.ngrok.io:19923

Mutex

71ad47bb-d541-40e7-9d2d-4f5b29133178

Attributes
  • encryption_key

    9683B34A1789E679FEE1A507A64F0B2A97781FB4

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cl.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections