Overview

overview

10

Static

static

10

cclent.exe

windows7-x64

10

cclent.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cclent.exe

  • Size

    3.1MB

  • MD5

    94222631ef1071a4f7ceb180cf8a4a5a

  • SHA1

    786d8b2d8b931a9282ee54367d2dda501f1ca946

  • SHA256

    a45b373b780f5b9fcf5c51473c69bbf0ed650f300523097602b35f5222bd122b

  • SHA512

    00503983a35e8d0f65eea6a811d7177a389cb1b4d8716d32e50fd5346deb428cd472cbaca7375c56ac3f113ea76db55322993b4d68d816b50a4b27887a2fa14d

  • SSDEEP

    49152:ivht62XlaSFNWPjljiFa2RoUYIo7RJ6SbR3LoGd+vTHHB72eh2NT:ivL62XlaSFNWPjljiFXRoUYIo7RJ6M

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

91.92.243.191:5401

Mutex

fce41024-0e2f-475b-929b-e58a126341bd

Attributes
  • encryption_key

    802CAE367B042C840DD4E29539BB1BFEC16FB48A

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    vchost32

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cclent.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections