General
-
Target
4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521.exe
-
Size
3.1MB
-
MD5
5c585cd5a2d292a0cb0be6b10cace921
-
SHA1
84b90137c36d741a4291aa22f4450c470ed9bd89
-
SHA256
4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521
-
SHA512
958c91d84c7e163fd473caf91363680347aa452aebdae76a4c01b39da790d003c20af6462bec3663c0208e8680ae2a9042fbc2c8ed8960e062dd51070fa39b27
-
SSDEEP
49152:avCI22SsaNYfdPBldt698dBcjHQCv1JSpoGdTvTHHB72eh2NT:avP22SsaNYfdPBldt6+dBcjHQCa
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
tieumao1995-51127.portmap.io:51127
Mutex
4119a2e0-4ae4-4843-8534-99af91a2475d
Attributes
-
encryption_key
DF6316067206E09C1F85138FCEBD56F5D94BF6AE
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
4c55655c8daeb51fb9592bfd3eb4e29e1a40fc89b13af090c52cbcd4b6390521.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections