General
-
Target
f7db4ec7a0359f0b078232a915cf579815d78201874ea87a915b57a3e278668e.exe
-
Size
3.1MB
-
MD5
70c0ee5e46a65955c63f59f16fb539b5
-
SHA1
1c832151726e1799d6cbc2382eabab61f7d563c9
-
SHA256
f7db4ec7a0359f0b078232a915cf579815d78201874ea87a915b57a3e278668e
-
SHA512
5027088ad40e56c1a8f779903668b81e37efaadd6e48ca7c855a9c7ba8c053b7aaa60b368dbc5ab2c00e4fa8ab753f598f6a3daaa554bd373cebfeb7ed5863fb
-
SSDEEP
49152:Svht62XlaSFNWPjljiFa2RoUYIQv7RBBxihoGdtJTHHB72eh2NTF:SvL62XlaSFNWPjljiFXRoUYIIRKw
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.1.125:4782
Mutex
18900002-3d71-4d3d-a3e4-f1b8ae453173
Attributes
-
encryption_key
F964335D77161C935F99410F722D66D3032FFF56
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
client
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
f7db4ec7a0359f0b078232a915cf579815d78201874ea87a915b57a3e278668e.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections