Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nun.exe

  • Size

    3.1MB

  • MD5

    dc0387558e4a130726bdca05d94636ab

  • SHA1

    816a296b33f2b0ec2d5abb6abc87cc55ab418dae

  • SHA256

    8d8223a9f7265b83029d744c364ec903806feb9ffd284e2b0b6ed083da04bd4a

  • SHA512

    5293a3b760b371b0ee8d035e25be4151e852c5742f5ae5c025d1ae0eeac655d6c786ba94d9c985dd2a2849362b44a0039baf14e3a3b750c713b7a0e5a226bdad

  • SSDEEP

    49152:3vyI22SsaNYfdPBldt698dBcjHINj77bR6LoGdGTHHB72eh2NT:3vf22SsaNYfdPBldt6+dBcjHIB7O

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.108:4782

Mutex

762b16a7-c943-4acc-82fa-9218267341e4

Attributes
  • encryption_key

    60588B031AB3F753713A86BD228C085945A06CE0

  • install_name

    TheBeams.exe

  • log_directory

    Checking

  • reconnect_delay

    3000

  • startup_key

    The Beams Startup

  • subdirectory

    TheBeams

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • nun.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections