Overview

overview

10

Static

static

10

BuiltFile-COOL.exe

windows7-x64

10

BuiltFile-COOL.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    BuiltFile-COOL.exe

  • Size

    3.1MB

  • MD5

    21c00a3945381e149c463658ccddd9c4

  • SHA1

    1dcc1b47e71a77873433e8a032f1997a82371847

  • SHA256

    57a15954866d64a8aa8cf6fd68b07b3ded8d42e66390d5dbbc0e1e135faf4246

  • SHA512

    86c705b8362d35136e7b8791e44bf570dcf7e7bf9931c7c98e243b96d1f8158e0fc2b041936c2f12a4ebd711748276bc77b23d36e895cb74b92772fb9de5429c

  • SSDEEP

    49152:KI6WGoyH0I6ZUI9IzyXfpVxXQjhoGQ+akTHHB72eh2NTkS4:KI9Gdl6ZUI9UefFgt8

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

147.185.221.20:15467

147.185.221.20:38852
Mutex

f0b11cef-e5ee-4de4-8050-d0e2b1ed200b

Attributes
  • encryption_key

    72276B19006F382DD49891C281A8AE57773E9723

  • install_name

    Update.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Update

  • subdirectory

    Keys

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • BuiltFile-COOL.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections