Overview

overview

10

Static

static

10

6d47dc0e01...7N.exe

windows7-x64

10

6d47dc0e01...7N.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6d47dc0e0136fd3d0fa3d604727ef9302a55405a14edfbc2e6070ad547290237N.exe

  • Size

    3.1MB

  • MD5

    c9b1b0f1caf30d788f7d5e8e7bbf2630

  • SHA1

    0701ea60ddd7fb7cc4b86722562313bf340632a9

  • SHA256

    6d47dc0e0136fd3d0fa3d604727ef9302a55405a14edfbc2e6070ad547290237

  • SHA512

    82bda10e77e1977b9afbb77c1c6ce4884c20e0e3cc28894a8990131773a6d58c3896f6ba0bc4386eea3fc05d486f83c20caa30b7a2ae503fd9b90df2c929d3ed

  • SSDEEP

    49152:Svht62XlaSFNWPjljiFa2RoUYIQv7RBBxihoGdtJTHHB72eh2NT:SvL62XlaSFNWPjljiFXRoUYIIRK

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.125:4782

Mutex

18900002-3d71-4d3d-a3e4-f1b8ae453173

Attributes
  • encryption_key

    F964335D77161C935F99410F722D66D3032FFF56

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    client

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6d47dc0e0136fd3d0fa3d604727ef9302a55405a14edfbc2e6070ad547290237N.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections