Overview

overview

10

Static

static

10

c8336d18c3...09.exe

windows7-x64

10

c8336d18c3...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8336d18c3361816fc9d6470ca313a41ca92878e8e465ccc2350d79d0e38ea09.exe

  • Size

    3.1MB

  • MD5

    dbe6648163a38bf88d16cd46cba60725

  • SHA1

    8e6456d6eb5a41be657e00e652685c6441e2ab9c

  • SHA256

    c8336d18c3361816fc9d6470ca313a41ca92878e8e465ccc2350d79d0e38ea09

  • SHA512

    81629676796e90b62ef26013318e1969148b7cf5e1e4cfe5456a84fa775f40b55fe7bb8ce47157beb91ecc6595f9128296c94cc05c4f2f77e508b6b0f014829f

  • SSDEEP

    49152:GvyI22SsaNYfdPBldt698dBcjHTUaEEak2k/mF6oGdwGTHHB72eh2NT:Gvf22SsaNYfdPBldt6+dBcjHTUamEg

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.29.147:4782

Mutex

7b6a0219-487d-4153-aef3-d8965465527b

Attributes
  • encryption_key

    C56BB8ACD2D4627CA39E0620C2CCEBAD8A4F4FF8

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c8336d18c3361816fc9d6470ca313a41ca92878e8e465ccc2350d79d0e38ea09.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections