Overview

overview

10

Static

static

10

83892117f9...ce.exe

windows7-x64

10

83892117f9...ce.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fe4ed0e2c6d830596d168ee32dc8a44239ca1705635187f67a0e40234c0f4c14

  • Size

    180KB

  • MD5

    0f97ded4f9f47b2e869905c0d09825cc

  • SHA1

    9c299a70a7371d1203f0e38e8d71ee1436f20808

  • SHA256

    fe4ed0e2c6d830596d168ee32dc8a44239ca1705635187f67a0e40234c0f4c14

  • SHA512

    50b713a2b014ca9c3bd6234d93bdf93ab69abc42f6d1da7dd63fd7bf10e3ccdc8c05f0779d973c6e0f0e842d5043607d4fa7d80dd0c21ecb9fffa56be798187c

  • SSDEEP

    3072:GZ+S8N2b0QchgAem/QFQn0p/OPqeMSyMZqMpJjiqDZ59BGEYB91nNl2zrwAcL/Nt:g+S8I4om/xn0EPuMq2JjiqL9RYlNlLNt

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

qztadmin.duckdns.org:9782

Mutex

QSR_MUTEX_YMblzlA3rm38L7nnxQ

Attributes
  • encryption_key

    mDf8ODHd9XwqMsIxpY8F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • fe4ed0e2c6d830596d168ee32dc8a44239ca1705635187f67a0e40234c0f4c14
    .zip

    Password: infected

  • 83892117f96867db66c1e6676822a4c0d6691cde60449ee47457f4cc31410fce.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections