Overview

overview

10

Static

static

10

Update.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Update.exe

  • Size

    413KB

  • MD5

    a47bdfa348d4ed9f8203656f8a62499a

  • SHA1

    7247d8dd2f0ee2f17164ceaac818952991dd8899

  • SHA256

    d84951f196002ba7b00af849ecb2b29ea9e61b3cee7a0dadb6fd595da3bd60b4

  • SHA512

    9ae9a0591684c34d3c0e883b8ca7275405c4c22cd80f6505e31aef86dff91ed97419d7a78727620e5a5b4d7e40f9e3fee4a2f85fc29c607d258108c9bb3c209c

  • SSDEEP

    6144:qNmEjkzQT1TVNe6AsBq61H+crK8mlbb/z3WdYfBJcxsq3GM:u1TVVwK1H+QPmxWKfBJcxsSGM

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Office04

C2

me-intranet.gl.at.ply.gg:13055

Mutex

$Sxr-plkPjnJnOsZ1prJqWh

Attributes
  • encryption_key

    sF4pQelXUnjCz70tuoBe

  • install_name

    COM Surrogate.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    COM Surrogate

  • subdirectory

    Windows

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Update.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections