Overview

overview

10

Static

static

10

Clientbuilt.exe

windows7-x64

10

Clientbuilt.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Clientbuilt.exe

  • Size

    3.1MB

  • MD5

    f661c3060aca2d816f6063c12660ad53

  • SHA1

    ce967b33af715ba6815b7153dd43f83bbf51059b

  • SHA256

    bdc6fefc4e36af9201fb64c296778e486a13a2f8a1e9169bc17a4440c3fa60e3

  • SHA512

    5333f95fbebec663f5508a8eb64d025d9ea8c7cb80e55d721abcca108b8172544c0377abd541a83182c214a538dd53f5ce42fabd5a8f99e2473d403dc0ddfd08

  • SSDEEP

    49152:8f0IvX+VPughoPAsTUuOtbrdoVZ7rltbxkCHHBX2ehJNTN:8f0IvXMPuoiAsIuOtbZoVZ7R

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

actually-saw.gl.at.ply.gg:19706

127.0.0.1:19706
Mutex

2c3d5585-57b9-4bf4-8dc3-7ba288f28e93

Attributes
  • encryption_key

    AB13A35D311D305CC9315C7EBB8FD93DF336A6F6

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Clientbuilt.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections