Overview

overview

10

Static

static

10

43738a30c4...18.exe

windows7-x64

10

43738a30c4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43738a30c4074ca0bef77f528fb75fb1_JaffaCakes118

  • Size

    349KB

  • MD5

    43738a30c4074ca0bef77f528fb75fb1

  • SHA1

    4197ff900d723691b0b33a924b6b34ad4dc15f33

  • SHA256

    212755a6fea93a698fcc12d08bdb6531c113377e8ddeef0c3185e54f3d2576ac

  • SHA512

    86d38ae3a245c155dfaef3a0928923bbccb338daae365b896c672aa98634376bfb113bb45c1bca68f361fc9cce964e1c12ab9971319779ba6f88c84370c2b259

  • SSDEEP

    6144:9K2J10qdSlEc39HG0qwmaS23MF+zK5rqt5YOqhLbyfdAVo2Vdd0d:9KFjq7c3FzK5rqcOYyKVoWdd0d

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

162.206.16.208:4782

Mutex

QSR_MUTEX_mnskLlemHhwg70HDrH

Attributes
  • encryption_key

    mvXuP4zPWoLOIqtuspGa

  • install_name

    bgfd.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windows Reg Start

  • subdirectory

    9807t43nfidyg

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 43738a30c4074ca0bef77f528fb75fb1_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections