General

  • Target
    STUB-XMONI.zip
  • Size 1.8MB
  • Sample240323-stvdnsbe8y
  • SHA256 8cb3a868e43a3476288192bd733619d417e29b3a29cfc17638485bdb9a18a740
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • quasar

Version
  • 1.4.1

Botnet
  • Office04

C2
  • DESKTOP-65LET2M:4782

Mutex
  • f9ab757a-065d-47c6-9119-97f5176ee58f

Attributes
  • encryption_key

    EEEC5AAC3122A97913C6635406AE314B5AC4B484

  • install_name

    Subdir.exe

  • log_directory

    Logs

  • reconnect_delay

    1

  • startup_key

    Subdir

  • subdirectory

    Subdir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 5 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • STUB-XMONI.zip
    .zip 1.8MB
  • GFXFileManager.dll
    .dll 448KB
  • README.txt
    123B
  • STUB-XMONI.exe
    .exe 3.1MB
  • api-ms-win-downlevel-advapi32-l2-1-0.dll
    .dll 3KB
  • ggponet.dll
    .dll 277KB
  • glib-2.0-0.dll
    .dll 1.0MB

STUB-XMONI.zip

  • SHA256 8cb3a868e43a3476288192bd733619d417e29b3a29cfc17638485bdb9a18a740
  • MD5 SHA1 SHA512 SSDEEP
Password
1234