General

  • Target

    24e7acb706dffb37b3e682424719f5ab.bin

  • Size

    1.2MB

  • MD5

    881ec1737c2e73fdaf6eccf181e8be7b

  • SHA1

    cc1a2d5bfaba9859a350f7dbe6849763468ff579

  • SHA256

    285e04c2bb8bd46ab0ba229bb888f386c8fba38be6ab038e8f80929ff207206a

  • SHA512

    eb289fc238d2539cbd11bb511a1a1e51b0c3d24160dd4c1ecdf84976a62aa16341cb4b28ce8709f439ed2db49fec24a8c7fe4ca43a128f2f035aac6098cead0e

  • SSDEEP

    24576:XVDZ13c69hQJHFsPbwToAJB0P9sHujykKnv/muRz/fMa9RN8idM2ZS9:FlJ9hAHFYsr0P9WGyk6vxffIfYS9

Score
10/10

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

Kneegrowless-33547.portmap.host:33547

Mutex

10674f25-f575-4b14-92cf-06a7073df875

Attributes
  • encryption_key

    E5427EE2BE27EB8DFAE76384CABC8A5EBB33EB00

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 24e7acb706dffb37b3e682424719f5ab.bin
    .zip

    Password: infected

  • 0972bb0ba1caff7adc92bb35f645b5e0d825fa74fb1b76ff822dce8c200ab30d.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections