Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    lolgg.exe

  • Size

    3.1MB

  • MD5

    0cb1197add877a20756fb8174a10a0ef

  • SHA1

    1c4cb81073becc1ab4d51dbd65eec82d91a854f8

  • SHA256

    bee2d43221fbe8e03ffbc29a0e60710795f05d2e597a94bae18cc84ebd0528db

  • SHA512

    d57a0ac85433d9e56f871e8125fb5ce24cd00f466b7ee31a3df4f94aed2034990ef0520854cf7d2ed739214b177ef4b190ea259aec4975538b325c2844cf6aff

  • SSDEEP

    49152:uvyI22SsaNYfdPBldt698dBcjHo//IE2HXk/uVXoGdbTHHB72eh2NT:uvf22SsaNYfdPBldt6+dBcjHo//Ep

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

86.13.66.89:4782

Mutex

584f887c-7024-4e16-a56b-684919f2613f

Attributes
  • encryption_key

    F478C43DE74A681AD4F5AF6B28E598051B310CDC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • lolgg.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections