Overview

overview

10

Static

static

10

0071e322a9...14.exe

windows7-x64

10

0071e322a9...14.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0071e322a9c03ee34e922ba862334c14.exe

  • Size

    3.1MB

  • MD5

    0071e322a9c03ee34e922ba862334c14

  • SHA1

    4f73e1fe18854be1f9ec55d6de5fe309ab6c71f2

  • SHA256

    65ff539e02c7cd85a96be341b2694b52b5258caecdaa603af9f280934c3cdac4

  • SHA512

    c97fc4513381420adb4e341624bb7b2edbc6eeac609a57c37e4f8631217e137667a8d9c6876ce14d65b7dbd1ae8ce628c8181395255016fca023835f78f1b470

  • SSDEEP

    98304:WIYdImPtmUO8P27flmCt1+eVRnADYEZxQI:bYPtORnA/r

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

118.195.235.103:4782

Mutex

71dd960d-f68a-4c48-b005-1abc3acf8e9b

Attributes
  • encryption_key

    87D90725875D825BD5FEC46A2A0B3CE8E2716E58

  • install_name

    Windows 任务的主机进程.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows 驱动程序基础 - 用户模式驱动程序框架主机进程

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0071e322a9c03ee34e922ba862334c14.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections