General
-
Target
41b6ef73bf31522453fc3550a529e9400c115cdc1a0aaba94e085694524cc5f5.exe
-
Size
3.1MB
-
MD5
62c7975abd55070b185e65d7521d7162
-
SHA1
8daec05ff1984ad1e7f2607f72a9092829ca7ea9
-
SHA256
41b6ef73bf31522453fc3550a529e9400c115cdc1a0aaba94e085694524cc5f5
-
SHA512
615ce6e32d1cae56890562b60d0803896054c5f3b9b05f812d6ac34435a3ad97c58d0d66ef5301341a16009485aef4253826cd492158d95adceecfc9079ed9db
-
SSDEEP
49152:rvbI22SsaNYfdPBldt698dBcjHyVxNESEnk/i1LoGdCTHHB72eh2NT4:rvk22SsaNYfdPBldt6+dBcjHkx+N8
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
Office04
C2
192.168.219.111:4782
Mutex
49d787b3-0fea-4746-8e18-a33027a94e42
Attributes
-
encryption_key
BD5280C2874A956B96E6A92745A817A564CC5CE5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
41b6ef73bf31522453fc3550a529e9400c115cdc1a0aaba94e085694524cc5f5.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections