General
-
Target
fc4b4bf760db7190dda618d474535110N
-
Size
3.1MB
-
MD5
fc4b4bf760db7190dda618d474535110
-
SHA1
cb63100fd426f00062fd28d9fd5c7ed93bc6300d
-
SHA256
6464d56018ff77cb963ad39ec30242dae31ec8f3c031932fabee5db56e4c875e
-
SHA512
5ff4a5163205d5a605dc73874bd438a3246b1cba5f6bb3ce09691562266ec854fca936b8fdadb551be0fab514ebd987c400aaa4f52427620d8b5b2a9d47f2e8c
-
SSDEEP
49152:jvOlL26AaNeWgPhlmVqvMQ7XSKwmRJ60bR3LoGd8nTHHB72eh2NT:jv+L26AaNeWgPhlmVqkQ7XSKwmRJ6+M
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
andrei2234231-23100.portmap.host:23100
Mutex
0ea0179b-0570-4ac9-87b6-31157f828b7f
Attributes
-
encryption_key
2ACAE8321CEC28A2EA43A5D91A6F70AA38BA3BB6
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
fc4b4bf760db7190dda618d474535110N
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections