Overview

overview

10

Static

static

10

932-9-0x00...ry.exe

windows7-x64

932-9-0x00...ry.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    932-9-0x0000000000400000-0x000000000045E000-memory.dmp

  • Size

    376KB

  • MD5

    8da519f0e2854c4d447f3663a6b13233

  • SHA1

    35f5701e2f856b5bfafe0f51b42c6eedb32747fb

  • SHA256

    70f5c0d595ac92051c354aa88de66239908229375a434ea409d527c896643edc

  • SHA512

    ccd851c0e590fcd55905e32bb607984ea935d5d7085e461e6730431fafd05b2e09cab2f167de32e52d0f3482adbbecd79893aa9056dbb7f2d1638f92406f6b0d

  • SSDEEP

    6144:PjEHwNHJslIGohkQOI2cMbyfldcQYbT+Jdq0Ja:bxpsl+RnldVYbiJdq4a

Score
10/10
office36quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office36

C2

94.156.64.6:7283

Mutex

QSR_MUTEX_jvYKL1Jk1Q2NTx58gc

Attributes
  • encryption_key

    LlEGluc1XmCcZfEs8y6n

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 932-9-0x0000000000400000-0x000000000045E000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections