Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    BruxWare Exec.rar

  • Size

    1.0MB

  • MD5

    55e88ccfc55fd5d7c28abe738d4a4ba4

  • SHA1

    200f71547676c5e812856d52853007f389e4c940

  • SHA256

    3146f85cf3842a7eb551d82c6f6ff16c4c7b9ac556d811ef6706cdb11975ff64

  • SHA512

    49dd91f205586042d4171900607e9b9a7f5c356aa992b482c656269a2a2b0d30ef34f015118375733f2e78eceb60574953942ec55e64d36a53ae00c20a5e2638

  • SSDEEP

    24576:dB0c9pjbp14NUZqEqrN9532WGqfgLUSJJZ71uA7ceGjBCbJn7wzfK:dBzXpW6ZJqJn3ZG/USPB8ArGwN7qi

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.7:4782

Mutex

e1a96595-1db6-442a-ae05-b00904a92f68

Attributes
  • encryption_key

    A289A5694D0AB3E82D9E70A7CB73065E9E325CBB

  • install_name

    BruxWare.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • BruxWare Exec.rar
    .rar
  • BruxWare Exec/BruxWare.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections