Overview

overview

10

Static

static

10

Windows Re...an.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Windows Remote Access Trojan.exe

  • Size

    3.1MB

  • MD5

    2c2172ccafa055a00312e4e3a08f229a

  • SHA1

    1c9dd30693318258d8ffd70984cb348d755c5d97

  • SHA256

    19b707de920bf77466108ba32a3d4b01fe051f46173db4bbf65c9e17895d9f55

  • SHA512

    ceecdee4cdb348a59f7b918b7c1d641e6ac398601493d87e1c91128387664effb457256cec427f71686cda808418003c8dc01ae9b22cb6ce76338237e5213225

  • SSDEEP

    49152:3vyI22SsaNYfdPBldt698dBcjHlqUMrtMfl5oGdBZTHHB72eh2NT:3vf22SsaNYfdPBldt6+dBcjHlrMrw

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.154:4782

Mutex

ba502bba-c1c8-4a0b-95e6-4b1a3d5f551e

Attributes
  • encryption_key

    7195172212FD0C3E2300AE89FC3318C365A0CFF8

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Windows Remote Access Trojan.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections