Overview

overview

10

Static

static

10

c66da9e2a3...3e.exe

windows7-x64

10

c66da9e2a3...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

  • Size

    3.1MB

  • MD5

    f73c79f1b3f1baaf66b5217591617996

  • SHA1

    7adf50ec4e343c7c890f360041206146bd166807

  • SHA256

    c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e

  • SHA512

    5ca6289d009234ce50b4fdbecb2c51898c812b7175af6d7753ffcdfac94c849530b13346b903d8b8f7fad240835c957fda0421fa73e97a1943410da3eb00a426

  • SSDEEP

    49152:PvFG42pda6D+/PjlLOlg6yQipV5PRJ6ebR3LoGdhTHHB72eh2NT:Pv842pda6D+/PjlLOlZyQipV5PRJ6Y

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

10.128.49.236:4783

10.128.49.71:4783

127.0.0.1:4783
Mutex

eeb9accf-baef-479b-ac89-0eaf9d0c2e80

Attributes
  • encryption_key

    7C1BD457B9B162A1B4E9153B6861CCB30916DB14

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c66da9e2a3e32a7b16c561e89623411d329bedb69a9d80f12ebfff7ba94a0e3e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections