Overview

overview

10

Static

static

10

8afaef0a36...5f.exe

windows7-x64

10

8afaef0a36...5f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8afaef0a36628f844cafde49e444269e880aef447b5edac70b6cbfd9120c2d5f.exe

  • Size

    3.1MB

  • MD5

    92f1e441ff6456ed112239c9e356e382

  • SHA1

    05a7b2def56a05cc3750aa8848b198eb08f51edc

  • SHA256

    8afaef0a36628f844cafde49e444269e880aef447b5edac70b6cbfd9120c2d5f

  • SHA512

    fe81cf37a0b140106d8e861fd257498a28999f69cde5ee6cb6d8bbc63025666d8a6db74a87dcf7f933d0e719594d00e08a014f9d27381055f21c500e73d3137c

  • SSDEEP

    49152:bvnI22SsaNYfdPBldt698dBcjH+bRJ6ZbR3LoGdG7bTHHB72eh2NT:bvI22SsaNYfdPBldt6+dBcjH+bRJ6b2

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

69.232.48.67:4782

Mutex

4ec0a816-0212-473a-be4d-984e4b0e9af0

Attributes
  • encryption_key

    06D1C1AE802ADF60C767026668B738AEF109004C

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8afaef0a36628f844cafde49e444269e880aef447b5edac70b6cbfd9120c2d5f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections