Overview

overview

10

Static

static

10

Rloader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rloader.exe

  • Size

    3.1MB

  • MD5

    c5dfb8e647dee65812059cb6a8392cd0

  • SHA1

    28905e70cea5495aa4dc1b7576a7429f8842da99

  • SHA256

    0d57ae77d8268afc0aa138efe70954cf3e4d40c8222e3c27994ddbc65f98b294

  • SHA512

    40f98296756b0a722b581e63cd906376f28afa5c8457a15defdfa147c17dee8a3dcf30c548bc87c5d4a30ae2948d5f8e8e0d6c3f0c0e70df26be1bfd817f4469

  • SSDEEP

    49152:PvAt62XlaSFNWPjljiFa2RoUYI2F9GBBeaLoNdWcTHHB72eh2NT:Pvs62XlaSFNWPjljiFXRoUYI6GX

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

89.244.81.23:4782

Mutex

2133a993-dae1-49b1-bfbb-4f8e5a998e93

Attributes
  • encryption_key

    667A5A03028317A85A6DC653E03053EE04F364BC

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    2000

  • startup_key

    Discord

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Rloader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections