Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    0e7400b7962021524550a5736d4c568d

  • SHA1

    517654e75ee5ac6581efdebf7ac55ffb4961452f

  • SHA256

    de51a9e30c97ce174b36d20b3dcadd6f5b3ed330491413373244813d36e6d3d5

  • SHA512

    f7ba6f8ee3b4ba0b119691876c1c8db8064dbe72e7dc8225192d6d70ce7f35837a8fed25d168a8d0cb23f53c1034de3eb1e6d3eab5d60b66b40ff10739cebe8d

  • SSDEEP

    49152:CvilL26AaNeWgPhlmVqvMQ7XSKi1RJ6JbR3LoGdM4THHB72eh2NT:CvaL26AaNeWgPhlmVqkQ7XSKi1RJ6L

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

23.84.85.170:3389

23.84.85.170:2032
Mutex

91e4434c-ab59-4a1a-931f-bd0739545abc

Attributes
  • encryption_key

    043DA72868D75E77D6E7D6B34CDE151E7FD08F30

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections