Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    878ebdf1e55421d4fdb712ba2e427cfe

  • SHA1

    fa6d04743a198c16261a3dbc14f6cd1f0fbc70aa

  • SHA256

    ee1411bf2015e16b221d444007a0b60b8f98f842e110198c3a2fb119b459a3da

  • SHA512

    cc9a4d7d4f411ba5b8836faceb1fae2605c96502f1f5f0b935e2c7a62bfe9641b84b30eba1ed3f12757c5cae244d5870bd153272d6760694f7f101e713f69173

  • SSDEEP

    49152:uvAG42pda6D+/PjlLOlg6yQipVZxOEMkKk/JxnoGd5K5THHB72eh2NT:uvD42pda6D+/PjlLOlZyQipVZxBx

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

http://stable-notably-hound.ngrok-free.app/:443

Mutex

8f9ed790-a4d4-42d4-a715-3c3c28f6d95b

Attributes
  • encryption_key

    A5F0EE2DBE7A3009387617912AFB48C127E2B576

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Client-built.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections