Overview

overview

10

Static

static

10

NovaWare V.3.exe

windows7-x64

10

NovaWare V.3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NovaWare V.3.exe

  • Size

    3.5MB

  • MD5

    f3c97ad109022357adf1efd83ee4008a

  • SHA1

    a244328dc018ac0e89e9bb7fe15edc4264fa4422

  • SHA256

    adde0d3454abb438006cba083245b964eb1945ff164809d784fbc0d61b1dfdf2

  • SHA512

    6992fae6ae4852380f9597bc207fd001a93734eb1bb2f5181c7e5b4051ac0c3c3bdeee4b46e5d3a3b5f41ab30cd5457e0335d98f236122d6c2bcf01e3fe9704c

  • SSDEEP

    98304:OvOL26AaNeWgPhlmVqkQ7XSKdJCwrqRqM+y+N32/rDc:wO4SPwAoB2j

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

eggballsbird-31516.portmap.host:31516

Mutex

6a8db52f-1bdf-4856-8cce-d200c8503544

Attributes
  • encryption_key

    A49DCA5598D0CD7A141F7624387E04CCB7142671

  • install_name

    NovaWare V3.1.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NovaWare V.3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections