General
-
Target
bc9a8ff70146de10ad5f822120c9abee2dd1f1e93f69038cbbd9dc574dae2570
-
Size
3.4MB
-
MD5
73fb4fbe3f3202a618aa74935779e3ac
-
SHA1
73c9f409c2f10ac0af8cffd3969b6b93b07768b4
-
SHA256
bc9a8ff70146de10ad5f822120c9abee2dd1f1e93f69038cbbd9dc574dae2570
-
SHA512
478f6a181b4f95a7d6f5c48f1a25fd88083eb18df759c89cc3227d70b12ca498447536b0bf77bc0a7c60bcd860c5f1ed2f837280bde7e41c0f078a51531b188e
-
SSDEEP
49152:3v7I22SsaNYfdPBldt698dBcjHuwAW1J3PoGdDTHHB72eh2NTi:3vE22SsaNYfdPBldt6+dBcjHuwAqL
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.1.15:4782
Mutex
400d2b6f-f5a4-4bb8-8ac1-572601b9847a
Attributes
-
encryption_key
28DB6A992E078CF6FE82A1042CC979D37C6466CE
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
bc9a8ff70146de10ad5f822120c9abee2dd1f1e93f69038cbbd9dc574dae2570
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections