Overview

overview

10

Static

static

10

experimentingnew.exe

windows10-1703-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    experimentingnew.exe

  • Size

    3.1MB

  • MD5

    399bbb3dc58bcc8cc2fe9aef9a3ebac5

  • SHA1

    37be03a9765a8b321c0ddf2ff00acdb106502b7b

  • SHA256

    821f6a7afc4b55e5b636deb590d71b6e5807ad2875cb7feca4e47e1dec7c3d98

  • SHA512

    98e70c54329089015535e30f32006ef8731e69dd32234590ef7f8388403cd68e86c5a4030083f8c510c46c7d0f995fe3a9a82db01a0b6fc288ea7eb5db5fa64f

  • SSDEEP

    49152:LvXlL26AaNeWgPhlmVqvMQ7XSKkZxNESEYk/iMLoGdHCTHHB72eh2NT:LvVL26AaNeWgPhlmVqkQ7XSKex/S3

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

0.tcp.eu.ngrok.io:15209

Mutex

2c47ae55-417f-4523-8ffe-361bacffde6b

Attributes
  • encryption_key

    5921775375700E0556963615862881AFA90D9F9F

  • install_name

    Microsoft Windows Search Indexer.exe

  • log_directory

    Discord

  • reconnect_delay

    3000

  • startup_key

    Runtime Broker

  • subdirectory

    svchost

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • experimentingnew.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections