Overview

overview

10

Static

static

10

e2ef548c1a...d7.exe

windows7-x64

10

e2ef548c1a...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2ef548c1a8a1624a0bf37ab59939bd62755bbd0d43a0419d86564b53383fcd7

  • Size

    3.1MB

  • MD5

    42a4b2ddf267c41ad37f9d278b9cb99d

  • SHA1

    8f78d2dfc7c33e26bd9ab86bb3e907b243ae43ba

  • SHA256

    e2ef548c1a8a1624a0bf37ab59939bd62755bbd0d43a0419d86564b53383fcd7

  • SHA512

    299981b520c93991bf5d0f76e5ad5e293ec92eb7f89f42e4296984994d7040df0d609de38f7bd1b3a07ec711c8f3150a4080daacec74bcbcc7516e750fbb3933

  • SSDEEP

    12288:NB08b8OrtRMdvlOVIkVovMdtL0CFnlzT83xKc:b080viI0ovMdtL0CFnlzTKKc

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

45.66.231.154:4782

Mutex

4304b988-116c-4522-ab83-7f9ad875f60f

Attributes
  • encryption_key

    A6B8B9B9B02FC86103A59CE003D7B3B45DAF8550

  • install_name

    svchost.exe

  • log_directory

    svchost

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    svchost

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e2ef548c1a8a1624a0bf37ab59939bd62755bbd0d43a0419d86564b53383fcd7
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections