Overview

overview

10

Static

static

10

e449e67559...6N.exe

windows7-x64

10

e449e67559...6N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66N.exe

  • Size

    348KB

  • MD5

    bdb7c04dc8eed14ec4f1b9a6017d8610

  • SHA1

    7144bf748917c7415573adf584cd81c435ebdeb6

  • SHA256

    e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66

  • SHA512

    2849e5300ce3e4f1ce12ea8824d9b0be2bcd6cf7d3b393901e66f1542d9acdf3e09d1d76a887dca6008bd5d07f3223b6f675d548af0a5b246fa40df68cae277e

  • SSDEEP

    6144:mzNHXf500MsYYQiLTVdbw35O7f6v/D2mGipQZb/cVXS:od50LOuOmvr2pipQZb/cVXS

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

192.168.252.1:4782

Mutex

QSR_MUTEX_nAO3ZxsttzfVnn6gik

Attributes
  • encryption_key

    XoQ4ARQwU8sc1owNPsxw

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e449e67559b963094612cee05ae3038edb44771a3ed0139fc675b8b34528dc66N.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections