Overview

overview

10

Static

static

10

d.exe

windows7-x64

10

d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d.exe

  • Size

    3.1MB

  • MD5

    d79b76080c30ab96613fd515652dbfd2

  • SHA1

    fade5dc9295c20ecddefb67c6040f31dd9f3382c

  • SHA256

    8f4a36920da7fbc02dae6b9d64887b8a9adf6d624b6bcc2fdde9b12b37df1248

  • SHA512

    5f6ca9fb9df9e40dbcbe1a25b213ca7dd978aaffacd8bd4f8dda2e08c98b641d885ed9592bfa2b454ea92ce2d7fb6e042c128b806f07267994869ce1f7908af5

  • SSDEEP

    49152:WvbI22SsaNYfdPBldt698dBcjHpb2x6oG2cGexX5THHB72eh2NT:Wvk22SsaNYfdPBldt6+dBcjHpb243

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.0.113:4782

Mutex

37397535-8af5-4add-b533-27e998fbc622

Attributes
  • encryption_key

    4B5E218560CDD01333207C62200755FCC6D3F14E

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections