General
-
Target
Bloxmoon-Predictor-free.exe
-
Size
3.2MB
-
MD5
ce93805d452be57633fc0e38763887e9
-
SHA1
2fb5e465238ca96ebc6f955cfc4bde27112ff274
-
SHA256
8d106f71a5aa03870ba5dddf04af6debaaf9a4e9e56a48067e5aa00cf320f727
-
SHA512
b35e4bac77849b2da7bc7f43d835e29ab0f2bd2a1ae9f8e8858cd1877703fb49c42b6badcc918e7533cc6d50cafdf0ef5c48c3fb84e1285d392dd430e1ce8024
-
SSDEEP
49152:7vbI22SsaNYfdPBldt698dBcjHBJRJ6HbR3LoGdjTHHB72eh2NT1:7vk22SsaNYfdPBldt6+dBcjHBJRJ6Zq
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.1.34:4782
Mutex
02ba042d-472f-4b7e-b3fd-5412a40a2cb7
Attributes
-
encryption_key
8BCA2555488EAA5FCF27A2654D564FF338A22CA4
-
install_name
Predictor.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
Bloxmoon-Predictor-free.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections