Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.4MB

  • MD5

    5563db885f9dff8a21515399173729af

  • SHA1

    699f3b02b8708ff390bea58f92380610aef1a016

  • SHA256

    a7213d2f57e96c1cc5e026f53eae26941ef1d64bdb3a588a96b81a3cbef92548

  • SHA512

    bae11f061c5bee115792c8e429b594b8d3980208c67a2f88ea76ccbf298e26978c57f1b32b564e2585c60e9c711d043c20e11f461b887fb1c30eb2731ed9aaac

  • SSDEEP

    98304:CvY62XlaSFNWPjljiFXRoUYIjhRJ6Dux:kQZYsC

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

gaykami.zapto.org:4782

Mutex

fd070244-4e4f-464f-bf66-b0519c62cf67

Attributes
  • encryption_key

    D408429A8F1C644E0A5D5AD709BD41BEADE3C3F6

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections