Overview

overview

10

Static

static

10

BootstrapperV1.20.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    BootstrapperV1.20.exe

  • Size

    3.1MB

  • MD5

    d224db65b950e94c4e62666c1cc12af0

  • SHA1

    9654b1222a321bc908e117cee75a951411664213

  • SHA256

    c70f12dd3565171d90fbdc95c64da144f08ec1166aba9e692de7ebbe823e966d

  • SHA512

    8938a60b4ce27ab9d1ff436e0bbc478f9a9df44dc84faac545b988bab9a5faad3069349c7411b7f51c652046b06dc5a2649dd8ebdb666fdb0d6f09eb739fc275

  • SSDEEP

    49152:Pvht62XlaSFNWPjljiFa2RoUYIUpRJ60bR3LoGdPKTHHB72eh2NT:PvL62XlaSFNWPjljiFXRoUYIUpRJ6+

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

89.233.193.186:4782

Mutex

785e4867-d8f5-4ec1-abf0-d128c3d5818c

Attributes
  • encryption_key

    433D3BA0BE0441D9BC31EE41658E1F2AB0CA43E7

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    google

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • BootstrapperV1.20.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections