Overview

overview

10

Static

static

10

d8e1f8133b...2c.exe

windows7-x64

10

d8e1f8133b...2c.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

  • Size

    502KB

  • MD5

    22dcffb27d97e5307563e371b2def462

  • SHA1

    3321cd46304f11dd4dc31a83b61a89d85ebfc548

  • SHA256

    d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c

  • SHA512

    abfbb8bae85508b36792d49a296a515f5827e95207a8eb075953b0a3cc95cdf7eb2e8c32565bc06b41d3c4e2e02fbbec45c7f53a5df246b18719cb272c74ab43

  • SSDEEP

    6144:dTEgdc0YtXAGbgiIN2RSBNZicdz7x3JXV6vjTcEDFb8F9tCUljY/10cTR3+:dTEgdfYBbgWcpaTKxjY/Wcd+

Score
10/10
office05quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office05

C2

38.180.9.93:4782

38.180.9.93:4783
Mutex

32672773-f3f5-4ec0-837a-7adbf29ae46f

Attributes
  • encryption_key

    C9BC046B617DD0F608706B9640C8D97C327969FB

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    esnt Startup

  • subdirectory

    SubDir

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects executables containing common artifacts observed in infostealers 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d8e1f8133b33f2a57c43088d2848c744e9a61aba41d52d019b1eb62fc4b1552c
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections