Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.txt

  • Size

    3.1MB

  • MD5

    392e90f36274a24ee8c8f1839675a368

  • SHA1

    6187de096ed93207bfb1a76e7b3117819d65ca54

  • SHA256

    9376c03517ce29bf94817da91aa034685c827fe8dadc19dcaab817dceafe8f64

  • SHA512

    44a4ebcc8945a9c5e30bcb8569508a18613847c8483c6817446a598b0d85ea33aa10816a8f4beb0a49269d1727ec0c2faa7b3d079b87f693134578115ee97a69

  • SSDEEP

    49152:CvyI22SsaNYfdPBldt698dBcjHL4mQmznLoGdgTHHB72eh2NT:Cvf22SsaNYfdPBldt6+dBcjHL4ml

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.11.20:4782

Mutex

18f9922e-d378-4916-842c-aa77698839ed

Attributes
  • encryption_key

    2C302960A864412274D2ACC228109C45F5512341

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.txt
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections