General
-
Target
9de1fd3e7a5040eff2447e7a150cb235bbb142bde577be989bdd357b7e410d93
-
Size
3.1MB
-
MD5
222a5c9ff144048cba8893ba2a2c3819
-
SHA1
eacfe03bed8910829de7a47adda07c6e5ba2e569
-
SHA256
9de1fd3e7a5040eff2447e7a150cb235bbb142bde577be989bdd357b7e410d93
-
SHA512
e59d50c50b3cc65ef4608e78764be6d1f7d4fca277311e27d6575ab3f14de7f970dc29cc3b1d0b8e2123459e3a6b7a5054d63b2b211434b3980aa8550d40c7f8
-
SSDEEP
49152:PvWI22SsaNYfdPBldt698dBcjHHtz6Bx3zoGdoTHHB72eh2NT:Pv722SsaNYfdPBldt6+dBcjHNz2
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office0-Jack
C2
192.168.8.159:4782
Mutex
be81a65c-66cd-42c9-84e8-ed754030e86c
Attributes
-
encryption_key
268C49675D14EB28391BEABE87432389860BF806
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
9de1fd3e7a5040eff2447e7a150cb235bbb142bde577be989bdd357b7e410d93
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections