Overview

overview

10

Static

static

10

Builder.exe

windows7-x64

10

Builder.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Builder.exe

  • Size

    3.1MB

  • MD5

    96d59e3441ebe09447f7bfd89213f58b

  • SHA1

    990492a28e44c8bc3f1d0adc068ea8010f289267

  • SHA256

    056fc71a10cdca7c56c2eeb13e845505f8b0b989abd11539e996ef8bd41df6c9

  • SHA512

    72cf986009f94f8128acde384991ab2b0248d83baefedca03f1c5f9d73131811126f73cb123db891f6c4ba95c9701ae11698b8a64501c1a72c86bd3636ffe1db

  • SSDEEP

    49152:mvUt62XlaSFNWPjljiFa2RoUYIyqRJ6LbR3LoGd0yBTHHB72eh2NT:mvI62XlaSFNWPjljiFXRoUYIyqRJ6dz

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.3:4782

Mutex

ca154ab3-671f-4846-8394-337d3ec234e8

Attributes
  • encryption_key

    584840608AFB8FCEACDF7322F6E7E40D33AAD77D

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Nvidia

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Builder.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections