General
-
Target
QuasarLanTest.exe
-
Size
3.1MB
-
MD5
e0537c132607a98cb4133bb066a74db2
-
SHA1
6a9b6335b9f091e0480fc7167b4d7304677ce08b
-
SHA256
a2b66f9f80d2add5e7b13f9e75b6c964e53d7aa2e52065b469b83f7e7c31fa7c
-
SHA512
eb4550090c17c2379455475f91fc637769ab72754fb30f1dd2228a0f18bec86e3eca46cee9f1201cfc3be8314b153633f22cced3cc2467d90d6b3b9d3e7bf65b
-
SSDEEP
49152:6vxt62XlaSFNWPjljiFa2RoUYIaPRJ6LbR3LoGdATHHB72eh2NT:6v762XlaSFNWPjljiFXRoUYIaPRJ6d
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.10.193:4455
Mutex
71f9480f-0626-42cf-aad4-d6f84c1c5e58
Attributes
-
encryption_key
C030D8F7F18781EB62BC0CFFC3F2B361D2649603
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
QClient
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
QuasarLanTest.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections