Overview

overview

10

Static

static

10

Lmao.exe

windows7-x64

10

Lmao.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Lmao.exe

  • Size

    3.1MB

  • MD5

    94a09a1f6f2202586f9bd8be9ac29f7d

  • SHA1

    86406fb4863433a3e213a52cf0240362ec0c1716

  • SHA256

    0d43a3b8a39ce9fcd764a1b223c7cfa1652de5743d67290cb7c2360dda8031ec

  • SHA512

    4a94505e833ddeceef582c56cfce00685856840acf6c89fad030670f41008dd295e5d8dd78f347eb86bfafbea0ad659ecf1ca8ec8c504301848303f246117eb6

  • SSDEEP

    49152:ifL8Pfc/PUO2hQgAYUu55TvFiZus30tQxFCHHBX2ehJNT2:ifL8PfsPUBugAHu55TtiZvk

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.0.0

Botnet

Office04

C2

friday-ebook.gl.at.ply.gg:13014

Mutex

21934bcc-b005-4385-8341-74b1c51eb936

Attributes
  • encryption_key

    D3F54E2FB3175647B03B5ACE78B726F38827C3D8

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Ruthless Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Lmao.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections