Overview

overview

10

Static

static

10

c66da9e2a3...3e.exe

windows7-x64

10

c66da9e2a3...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

  • Size

    3.1MB

  • Sample

    240601-tzyhysgf41

  • MD5

    f73c79f1b3f1baaf66b5217591617996

  • SHA1

    7adf50ec4e343c7c890f360041206146bd166807

  • SHA256

    c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

  • SHA512

    5ca6289d009234ce50b4fdbecb2c51898c812b7175af6d7753ffcdfac94c849530b13346b903d8b8f7fad240835c957fda0421fa73e97a1943410da3eb00a426

  • SSDEEP

    49152:PvFG42pda6D+/PjlLOlg6yQipV5PRJ6ebR3LoGdhTHHB72eh2NT:Pv842pda6D+/PjlLOlZyQipV5PRJ6Y

Score
10/10
quasaroffice04spywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.128.49.236:4783

10.128.49.71:4783

127.0.0.1:4783
Mutex

eeb9accf-baef-479b-ac89-0eaf9d0c2e80

Attributes
  • encryption_key

    7C1BD457B9B162A1B4E9153B6861CCB30916DB14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

    • Size

      3.1MB

    • MD5

      f73c79f1b3f1baaf66b5217591617996

    • SHA1

      7adf50ec4e343c7c890f360041206146bd166807

    • SHA256

      c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

    • SHA512

      5ca6289d009234ce50b4fdbecb2c51898c812b7175af6d7753ffcdfac94c849530b13346b903d8b8f7fad240835c957fda0421fa73e97a1943410da3eb00a426

    • SSDEEP

      49152:PvFG42pda6D+/PjlLOlg6yQipV5PRJ6ebR3LoGdhTHHB72eh2NT:Pv842pda6D+/PjlLOlZyQipV5PRJ6Y

    Score
    10/10
    quasaroffice04spywaretrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks