General
-
Target
6700ee6916de2b466bfba8efd9d0aaa71cf99252d3f95c570c366819a45ab2ce
-
Size
3.1MB
-
MD5
e0bd71734fc197f5d445a0220c946718
-
SHA1
0bf01f37003f8474f7e038a5846a8f3d1231ab4f
-
SHA256
6700ee6916de2b466bfba8efd9d0aaa71cf99252d3f95c570c366819a45ab2ce
-
SHA512
f637d2e0a69f6d0228f67c62c1391e2be8c2e8bde13bcfd676f5eba9960464d9f87494fd4aa146b86bfb38c1870e16e8b48dcf0b937805b60e27df14905e1a4f
-
SSDEEP
49152:P3ye82ipaSmopPZlGPBbLbrJSrMayVgjokdtNTHHB72eh2NT:P3982ipaSmopPZlGPBnbrJSrMayVK
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
45.66.231.154:4782
Mutex
4304b988-116c-4522-ab83-7f9ad875f60f
Attributes
-
encryption_key
A6B8B9B9B02FC86103A59CE003D7B3B45DAF8550
-
install_name
svchost.exe
-
log_directory
svchost
-
reconnect_delay
3000
-
startup_key
svchost
-
subdirectory
svchost
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
6700ee6916de2b466bfba8efd9d0aaa71cf99252d3f95c570c366819a45ab2ce
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections