Overview

overview

10

Static

static

10

not a bomb.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    not a bomb.zip

  • Size

    1.2MB

  • MD5

    09f7f885cd740d1c7b8adb3e806318bb

  • SHA1

    a3c8226ad60c0adf7820881903900e41bf2954a2

  • SHA256

    6f20309b4efae0c6b0e0ea1833da21b47464b4cb52b0feae0ca0a3c10da82953

  • SHA512

    2ce9a16ee36ea2ba0ed587788ad8fba21cafed3cb1157c87d83c1bd21cf1130d9b3710c27837efff0dfc037a2de657142171b102b341e565c990218ef560f996

  • SSDEEP

    24576:g5wmhcnpEpAidGFuy9idk3EIg/oSxqyqmC4Qy5d8MVhEwEs5hlveQb:H8cnpEqidGFX986/gtbf7Tl5jeQb

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

gakimyny-40562.portmap.host:40562

Mutex

46e7ef3b-8d62-4396-a1b6-7d8a2353e907

Attributes
  • encryption_key

    4CCD03EE2B3F5EBE1286E32B25E48A9D2C6CC0F5

  • install_name

    incognito.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    CrashHandler

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • not a bomb.zip
    .zip
  • not a bomb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections