Overview

overview

10

Static

static

10

aaaa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    aaaa.exe

  • Size

    3.1MB

  • MD5

    7e70b9bb34b1a42cc1a00839f691551e

  • SHA1

    ea158e6eda66116dfd5f119359f29b38413c6c5b

  • SHA256

    0f625db7dc4354fac55dd6b4232f6ddf4d1852d8876a293f613c4db846827544

  • SHA512

    a3ab1d10f92d916613852c6465bc99c799298b4295386ebb3eab442fe7ff8a50d9120f62fb47b5286d3c81128296a50949e936fe778456e3dc38ef2ec588d538

  • SSDEEP

    49152:2vfI22SsaNYfdPBldt698dBcjHzskd1vjLoGWt/LTHHB72eh2NT:2vw22SsaNYfdPBldt6+dBcjHzskHo

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

aceecfe-54332.portmap.host:54332

Mutex

a05901d8-e554-46df-b075-6e7b289aa30e

Attributes
  • encryption_key

    8B919D2B8267D63C06558D84398A4F9D7BEDA998

  • install_name

    System32.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Runtime Broker

  • subdirectory

    System Files

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • aaaa.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections