Overview

overview

10

Static

static

10

1ba41fb95f...80.exe

windows7-x64

10

1ba41fb95f...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80.exe

  • Size

    502KB

  • MD5

    f5b150d54a0ba2d902974cbfd6249c56

  • SHA1

    92e28c3d9ff4392eed379d816dda6939113830bd

  • SHA256

    1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

  • SHA512

    57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

  • SSDEEP

    12288:gTEgdfYv/izUrFL4dywjapf/WI2TI/uqcdj:1Uwwq+ywjapHWbEcdj

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.31.99:4782

2001:4bc9:1f98:a4e::676:4782

255.255.255.0:4782

fe80::cabf:4cff:fe84:9572%17:4782
Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes
  • encryption_key

    A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9

  • install_name

    Neverlose Loader.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections